PT-2015-3176 · Adobe · Connect

Stas Volfus · Publicado 2015-06-13 · Atualizado 2016-12-31 · CVE-2015-0343

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Adobe Connect versions prior to 9.4

Description The issue exists due to inadequate protection of the web page structure in Adobe Connect, allowing for the exploitation of a cross-site scripting (XSS) vulnerability. This can enable a remote attacker to inject arbitrary web script or HTML code using query parameters, such as the query parameter in the admin/home/homepage/search endpoint.

Recommendations For Adobe Connect versions prior to 9.4, update to version 9.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin/home/homepage/search endpoint in the web app to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2016-00546

CVE-2015-0343

Produtos afetados

Connect

Referências · 8

• https://bdu.fstec.ru/vul/2016-00546 · Nota de Segurança
• https://helpx.adobe.com/adobe-connect/release-note/connect-94-release-notes.html#Issues%20Resolved · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2015/Jun/35 · Nota
• http://packetstormsecurity.com/files/132269/Adobe-Connect-9.3-Cross-Site-Scripting.html · Nota
• http://securitytracker.com/id/1032567 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-0343 · Nota de Segurança
• http://seclists.org/bugtraq/2015/Jun/61 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0343 · Nota