PT-2013-5103 · Jahia · Jahia Xcm

Publicado 2013-11-27 · Atualizado 2013-11-29 · CVE-2013-4624

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jahia xCM version 6.6.1.0 before hotfix 7

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur via several parameters, including the site parameter to the "engines/manager.jsp" endpoint, the searchString parameter to the "administration/" endpoint in a search action, and the username, firstName, lastName, email, or organization fields to the "administration/" endpoint in a users action.

Recommendations For Jahia xCM version 6.6.1.0 before hotfix 7, apply hotfix 7 to resolve the issue. As a temporary workaround, consider restricting access to the "engines/manager.jsp" and "administration/" endpoints until the hotfix is applied. Additionally, avoid using the vulnerable parameters site, searchString, username, firstName, lastName, email, and organization in the respective actions until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2013-4624

Produtos afetados

Jahia Xcm

Referências · 4

• 🔥 https://htbridge.com/advisory/HTB23159 · Exploit
• 🔥 https://exploit-db.com/exploits/38682 · Exploit
• 🔥 https://exploit-db.com/exploits/38683 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-4624 · Nota de Segurança