← Vulnerability feed

Vulnerability record · CVE-2013-7025 · published 9 December 2013

CVE-2013-7025: Sonicwall analyzer cross-site scripting vulnerability

Sonicwall · Analyzer

Multiple cross-site scripting (XSS) vulnerabilities in ematStaticAlertTypes.jsp in the Alert Settings section in Dell SonicWALL Global Management System (GMS), Analyzer, and UMA EM5000 7.1 SP1 before Hotfix 134235 allow remote authenticated users to inject arbitrary web script or HTML via the (1) valfield_1 or (2) value_1 parameter to createNewThreshold.jsp.

3.5 CVSS 2.0 Low EPSS 4.3% · top 9.1% CWE-79 · Cross-site scripting
3.5CVSS 2.0 base score
4.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
20References, 8 tagged exploit
17 Jun 2026Last modified by NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in ematStaticAlertTypes.jsp in the Alert Settings section in Dell SonicWALL Global Management System (GMS), Analyzer, and UMA EM5000 7.1 SP1 before Hotfix 134235 allow remote authenticated users to inject arbitrary web script or HTML via the (1) valfield_1 or (2) value_1 parameter to createNewThreshold.jsp.

AV:N/AC:M/Au:S/C:N/I:P/A:N

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://archives.neohapsis.com/archives/bugtraq/2013-12/0022.html Third Party Advisory
http://osvdb.org/100610 Broken Link
http://seclists.org/fulldisclosure/2013/Dec/32 ExploitMailing ListThird Party Advisory
http://secunia.com/advisories/55923 Third Party Advisory
http://www.exploit-db.com/exploits/30054 ExploitThird Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/64103 ExploitThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1029433 Third Party AdvisoryVDB Entry
http://www.sonicwall.com/us/shared/download/Support_Bulletin_GMS_Vulnerability_Hotfix_134235.pdf Vendor Advisory
http://www.vulnerability-lab.com/get_content.php?id=1099 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/89462 VDB Entry
http://archives.neohapsis.com/archives/bugtraq/2013-12/0022.html Third Party Advisory
http://osvdb.org/100610 Broken Link
http://seclists.org/fulldisclosure/2013/Dec/32 ExploitMailing ListThird Party Advisory
http://secunia.com/advisories/55923 Third Party Advisory
http://www.exploit-db.com/exploits/30054 ExploitThird Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/64103 ExploitThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1029433 Third Party AdvisoryVDB Entry
http://www.sonicwall.com/us/shared/download/Support_Bulletin_GMS_Vulnerability_Hotfix_134235.pdf Vendor Advisory
http://www.vulnerability-lab.com/get_content.php?id=1099 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/89462 VDB Entry

Track CVE-2013-7025 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2016-2396Sonicwall analyzer command injection vulnerabilityThe GMS ViewPoint (GMSVP) web application in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote authen…EPSS 4.7%9.8CVE-2023-34136Sonicwall analytics unrestricted file upload vulnerabilityVulnerability in SonicWall GMS and Analytics allows unauthenticated attacker to upload files to a restricted location not controlled by the attacker.…EPSS 0.80%9.8CVE-2023-34132Sonicwall analytics vulnerabilityUse of password hash instead of password for authentication vulnerability in SonicWall GMS and Analytics allows Pass-the-Hash attacks. This issue aff…EPSS 7.7%9.8CVE-2023-34137Sonicwall analytics improper authentication vulnerabilitySonicWall GMS and Analytics CAS Web Services application use static values for authentication without proper checks leading to authentication bypass …EPSS 1.0%9.8CVE-2023-34130Sonicwall analytics broken cryptographic algorithm vulnerabilitySonicWall GMS and Analytics use outdated Tiny Encryption Algorithm (TEA) with a hardcoded key to encrypt sensitive data. This issue affects GMS: 9.3.…EPSS 0.31%9.8CVE-2023-34124SonicWall GMS and Analytics Web Services authentication bypassThe authentication mechanism in SonicWall GMS and Analytics Web Services performs insufficient checks, allowing an unauthenticated attacker to bypass…EPSS 50%analysed9.8CVE-2023-34128Sonicwall analytics insufficiently protected credentials vulnerabilityTomcat application credentials are hardcoded in SonicWall GMS and Analytics configuration file. This issue affects GMS: 9.3.2-SP1 and earlier version…EPSS 0.71%9.8CVE-2022-22280Sonicwall analytics sql injection vulnerabilityImproper Neutralization of Special Elements used in an SQL Command leading to Unauthenticated SQL Injection vulnerability, impacting SonicWall GMS 9.…EPSS 9.5%

Source: NIST National Vulnerability Database (record CVE-2013-7025), CISA KEV, FIRST EPSS (scores of 2026-10-03). This page is refreshed as NVD updates the record.