PT-2014-4022 · Telligent · Telligent Evolution

Publicado 2014-02-27 · Atualizado 2019-07-18 · CVE-2014-1223

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Telligent Evolution versions prior to 6.1.19.36103 Telligent Evolution versions 7.x prior to 7.1.12.36162 Telligent Evolution versions 7.5.x Telligent Evolution versions 7.6.x prior to 7.6.7.36651

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the msg parameter in the controlpanel/loading.aspx endpoint.

Recommendations For versions prior to 6.1.19.36103, update to version 6.1.19.36103 or later. For versions 7.x prior to 7.1.12.36162, update to version 7.1.12.36162 or later. For versions 7.5.x, update to a version that is not affected, as specific fixed versions for this range are not provided. For versions 7.6.x prior to 7.6.7.36651, update to version 7.6.7.36651 or later. As a temporary workaround, consider restricting access to the controlpanel/loading.aspx endpoint to minimize the risk of exploitation. Avoid using the msg parameter in this endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-1223

Produtos afetados

Telligent Evolution

Referências · 5

• 🔥 http://securityfocus.com/bid/65739 · Exploit
• 🔥 https://portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1223 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-1223 · Nota de Segurança
• http://secunia.com/advisories/56779 · Aviso do Fabricante
• http://securityfocus.com/archive/1/531223/100/0/threaded · Nota