topic cross-site scripting vulnerability. 3com switch 4210 in Security e-Series

cross-site scripting vulnerability. 3com switch 4210

mrussell — Mon, 29 Nov 2010 23:32:44 GMT

I have a HP / 3com 4210 18 port switch on my network, which failed PCI compliance due to a cross site scripting vulnerability via the web interface.

Is there a firmware fix for this? If not, is it possible to disable the web interface or port 80?

Any suggestions apperciated

thanks

Re: cross-site scripting vulnerability. 3com switch 4210

Fredrik Lönnman — Tue, 30 Nov 2010 07:53:02 GMT

Hi,

You can restrict access to the web gui via ip http acl <acl> or disable it with undo ip http in system-view.

Regards

Fredrik

Re: cross-site scripting vulnerability. 3com switch 4210

mrussell — Tue, 30 Nov 2010 18:30:07 GMT

Thanks Fredrik, that's exactly what i was loking for. I connected via CLI, went to system-view and entered undo ip http shutdown, and it disabled the web service.