PT-2014-4023 · Rexx · Rexx Recruitment

Publicado 2014-10-06 · Atualizado 2018-10-09 · CVE-2014-1224

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions rexx Recruitment versions R6.1 through R7 without fixes from 2014-01-15

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via the oninput event handler in the fname parameter to the default URI in "/reg".

Recommendations For versions R6.1 through R7 without fixes from 2014-01-15, apply the fixes from 2014-01-15 to resolve the issue. As a temporary workaround, consider restricting access to the user registration feature or disabling the oninput event handler in the fname parameter to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-1224

Produtos afetados

Rexx Recruitment

Referências · 5

• 🔥 https://redteam-pentesting.de/en/advisories/rt-sa-2014-002/-rexx-recruitment-cross-site-scripting-in-user-registration · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Mar/389 · Exploit
• http://secunia.com/advisories/56310 · Nota
• http://securityfocus.com/archive/1/531654/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-1224 · Nota de Segurança