PT-2014-8617 · Jexperts · Jexperts Channel Platform

Publicado 2014-11-13 · Atualizado 2017-09-08 · CVE-2014-8557

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions JExperts Channel Platform version 5.0.33 CCB

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the usuario.nome variable in an 'editarUsuario' action to 'usuario.do' or the titulo.form variable in a 'novoChamado' action to 'ticket.do'.

Recommendations For JExperts Channel Platform version 5.0.33 CCB, as a temporary workaround, consider restricting access to the 'usuario.do' and 'ticket.do' endpoints until a patch is available. Avoid using the usuario.nome and titulo.form variables in the affected actions until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-8557

Produtos afetados

Jexperts Channel Platform

Referências · 5

• 🔥 http://seclists.org/fulldisclosure/2014/Nov/9 · Exploit
• 🔥 http://packetstormsecurity.com/files/129009/JExperts-Tecnologia-Channel-Software-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-8557 · Nota de Segurança
• http://securityfocus.com/bid/70967 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98532 · Nota