PT-2013-6166 · Cru · Cru Ditto Forensic Fieldstation

Martin Wundram · Publicado 2013-12-17 · Atualizado 2014-01-14 · CVE-2013-6882

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions CRU Ditto Forensic FieldStation versions 2013Oct15a and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML via the username parameter in a login. Additionally, remote authenticated users can inject arbitrary web script or HTML via unspecified form fields.

Recommendations For CRU Ditto Forensic FieldStation versions 2013Oct15a and earlier, update the firmware to a version later than 2013Oct15a to resolve the issue. As a temporary workaround, consider restricting access to the login functionality and unspecified form fields to minimize the risk of exploitation. Avoid using the username parameter in the affected login endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2013-6882

Produtos afetados

Cru Ditto Forensic Fieldstation

Referências · 8

• 🔥 https://exploit-db.com/exploits/30396 · Exploit
• 🔥 http://exploit-db.com/exploits/30396 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2013/Dec/80 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-6882 · Nota de Segurança
• http://osvdb.org/100996 · Nota
• http://osvdb.org/101000 · Nota
• http://packetstormsecurity.com/files/124420/Ditto-Forensic-FieldStation-2013Oct15a-XSS-CSRF-Command-Execution.html · Nota
• http://secunia.com/advisories/55989 · Nota