PT-2007-6269 · Grouplink · Grouplink Ehelpdesk

Publicado 2007-10-03 · Atualizado 2017-07-29 · CVE-2007-5176

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions GroupLink eHelpDesk version 6.2.2

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the NA DISPLAYNAME parameter in "helpdesk/user/rf create.jsp", and the username and LDAPError parameters in "index2.jsp".

Recommendations For version 6.2.2, consider restricting access to the vulnerable parameters NA DISPLAYNAME, username, and LDAPError in the respective API endpoints until a patch is available. As a temporary workaround, avoid using these parameters in "helpdesk/user/rf create.jsp" and "index2.jsp" to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-5176

Produtos afetados

Grouplink Ehelpdesk

Referências · 7

• http://secunia.com/advisories/26892 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-5176 · Nota de Segurança
• http://osvdb.org/37536 · Nota
• http://securityfocus.com/bid/25870 · Nota
• http://osvdb.org/37535 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36885 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36886 · Nota