An administrative cross-site scripting (XSS) vulnerability exists in the web user interface dashboard layout of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). Unvalidated user-supplied variables are echoed back to administrative profiles, facilitating vector payload processing behavior controls.
The recommended resolution is to upgrade to NGFW Version 17.4.1 at your earliest convenience.
Configurations
A successful attack requires administrative privileges to target UI entry forms and relies on session interaction parsing from a secondary administrator browser window.
Workarounds
Per operational best practice security models, do not allow unauthorized administrative access to the administrative browser.