PT-2011-3271 · Grapecity · Data Dynamics Reports

Publicado 2011-04-10 · Atualizado 2018-10-09 · CVE-2011-1660

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions GrapeCity Data Dynamics Reports versions prior to 1.6.2084.14

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the DataDynamics.Reports.Web class library. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters to certain JavaScript files, as reachable by CoreHandler.ashx. The vulnerable parameters include reportName, uniqueId, and traceLevel in CoreViewerInit.js and CoreController.js.

Recommendations For versions prior to 1.6.2084.14, update to version 1.6.2084.14 or later to resolve the issue. As a temporary workaround, consider restricting access to the CoreHandler.ashx endpoint and limiting the use of the reportName, uniqueId, and traceLevel parameters in CoreViewerInit.js and CoreController.js until the update is applied.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2011-1660

Produtos afetados

Data Dynamics Reports

Referências · 8

• 🔥 http://securityfocus.com/bid/47015 · Exploit
• http://osvdb.org/71488 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66545 · Nota
• http://secunia.com/advisories/43953 · Aviso do Fabricante
• http://securityreason.com/securityalert/8190 · Nota
• http://securityfocus.com/archive/1/517244/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-1660 · Nota de Segurança
• http://gcpowertools.com/DownloadLatestVersion · Correção