{"id":"CVE-2015-20130","kind":"vulnerability","aliases":["CVE-2015-20130"],"related":[],"title":"Netsweeper: reflected XSS in admin log viewer runs script in browser","description":"Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/view_server_log.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HTML response without output encoding. Attackers can craft a malicious URL and induce a user to request it, resulting in arbitrary JavaScript execution within the victim's browser session against the Netsweeper web administration interface. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.","summary":"Netsweeper's web admin page view_server_log.php reflects the log parameter into its HTML without encoding it. A remote attacker who tricks an administrator into opening a crafted link can run JavaScript in that administrator's browser session on the Netsweeper admin interface.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","netsweeper","self-hosted","web-filter"],"not_affected_if":["admin-interface-restricted","patched-version"],"how_to_check":"- Look for `webadmin/reporter/view_server_log.php` on Netsweeper web administration servers\n- Check the installed Netsweeper version against the fixed releases; `unknown` for the exact command on your install","fix":"- Netsweeper `4.0.x` before `4.0.11`: move to `4.0.11`\n- Netsweeper `4.1.x` before `4.1.5`: move to `4.1.5`","status":"open","published_at":"2026-10-30T15:16:44+00:00","first_seen_at":"2026-10-30T15:31:09+00:00","triaged_at":"2026-10-30T15:33:33+00:00","updated_at":"2026-10-30T15:33:33+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-30T15:33:33Z","model":"claude-haiku-5-5","output":{"fix":"- Netsweeper `4.0.x` before `4.0.11`: move to `4.0.11`\n- Netsweeper `4.1.x` before `4.1.5`: move to `4.1.5`","reach":"internet","title":"Netsweeper: reflected XSS in admin log viewer runs script in browser","impact":"medium","summary":"Netsweeper's web admin page view_server_log.php reflects the log parameter into its HTML without encoding it. A remote attacker who tricks an administrator into opening a crafted link can run JavaScript in that administrator's browser session on the Netsweeper admin interface.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["netsweeper","web-filter","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs JavaScript in an admin's browser session on Netsweeper","analyst_note":"Confirm whether the admin interface is internet-facing in practice and whether exploitation observed by Shadowserver on 2023-10-19 has further detail; source NVD only.","how_to_check":"- Look for `webadmin/reporter/view_server_log.php` on Netsweeper web administration servers\n- Check the installed Netsweeper version against the fixed releases; `unknown` for the exact command on your install","plain_action":"","needs_analyst":true,"not_affected_if":["patched-version","admin-interface-restricted"],"who_is_affected":"Organisations that run the Netsweeper web filter with its web administration interface reachable to staff or the internet. The exposure is through the admin UI, so the risk is highest where administrators browse from the same network or can be sent a link. Installations on patched versions or with the admin interface restricted to trusted hosts are less exposed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000751,"input_tokens":4250,"output_tokens":652,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-10':153C '-19':154C '-20130':14A,17A '-2015':13A,16A '2023':152C '4.0.11':70C '4.1.0':72C '4.1.5':74C 'admin':5A,29B,66B 'administr':48B,59B,140C 'allow':86C 'arbitrari':91C,127C 'attack':44B,88C,112C 'browser':11A,61B,134C 'code':96C 'contain':75C 'craft':52B,114C 'cross':79C 'cross-sit':78C 'cve':12A,15A 'encod':40B,111C 'evid':143C 'execut':90C,129C 'exploit':142C 'filter':25B 'first':145C 'foundat':150C 'host':22B 'html':38B,107C 'induc':119C 'infrastructur':18B 'inject':94C 'interfac':67B,141C 'javascript':56B,92C,128C 'link':53B 'log':6A,34B,99C 'malici':95C,116C 'netsweep':1A,19B,26B,65B,68C,138C 'observ':146C 'open':50B 'output':110C 'page':30B 'paramet':35B,101C 'reflect':2A,32B,77C,104C 'remot':43B,87C 'request':100C,123C 'respons':108C 'result':125C 'run':8A,55B 'script':9A,81C 'self':21B 'self-host':20B 'session':62B,135C 'shadowserv':149C 'site':80C 'trick':46B 'url':117C 'user':121C 'victim':132C 'view_server_log.php':31B 'viewer':7A 'vulner':82C 'web':24B,28B,139C 'web-filt':23B 'webadmin/reporter/view_server_log.php':84C 'within':130C 'without':39B,109C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Organisations that run the Netsweeper web filter with its web administration interface reachable to staff or the internet. The exposure is through the admin UI, so the risk is highest where administrators browse from the same network or can be sent a link. Installations on patched versions or with the admin interface restricted to trusted hosts are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2015-20130","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-20130","severity":null,"published_at":"2026-10-30T15:16:44+00:00","modified_at":"2026-10-30T15:16:44+00:00","first_seen_at":"2026-10-30T15:31:09+00:00","fetched_at":"2026-10-30T15:31:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}