PT-2012-3712 · Schneider Electric · Kerwin+1

Publicado 2012-05-22 · Atualizado 2013-05-15 · CVE-2012-1990

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Schneider Electric Kerweb versions prior to 3.0.1 Schneider Electric Kerwin versions prior to 6.0.1

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the evtvariablename parameter in an evts.xml action to kw.dll, unspecified search fields, or unspecified content-display fields.

Recommendations For Schneider Electric Kerweb versions prior to 3.0.1, update to version 3.0.1 or later. For Schneider Electric Kerwin versions prior to 6.0.1, update to version 6.0.1 or later. As a temporary workaround, consider restricting access to the kw.dll and evts.xml actions until a patch is available. Avoid using the evtvariablename parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-1990

Produtos afetados

Kerweb

Kerwin

Referências · 5

• 🔥 https://exploit-db.com/exploits/37137 · Exploit
• http://phocean.net/2012/05/08/cve-2012-1990-kerwebkerwin-xss-vulnerabilities.html · Nota
• http://secunia.com/advisories/49041 · Aviso do Fabricante
• http://securityfocus.com/bid/53409 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-1990 · Nota de Segurança