PT-2015-6230 · Thycotic · Thycotic Secret Server

Marco Delai · Publicado 2015-07-02 · Atualizado 2018-10-09 · CVE-2015-3443

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Thycotic Secret Server versions 8.6.x through 8.8.x before 8.8.000005

Description A cross-site scripting (XSS) issue exists in the basic dashboard, allowing remote authenticated users to inject arbitrary web script or HTML via a password entry. This occurs because the password entry is not properly handled when toggling the password mask.

Recommendations For Thycotic Secret Server versions 8.6.x through 8.8.x before 8.8.000005, update to version 8.8.000005 or later to resolve the issue. As a temporary workaround, consider restricting access to the basic dashboard to minimize the risk of exploitation. Avoid using the password entry feature in the affected dashboard until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-3443

Produtos afetados

Thycotic Secret Server

Referências · 7

• 🔥 https://exploit-db.com/exploits/37394 · Exploit
• 🔥 http://csnc.ch/misc/files/advisories/CVE-2015-3443_Thycotic_Secret_Server_XSS.TXT · Exploit
• http://securityfocus.com/archive/1/535821/100/0/threaded · Nota
• http://securityfocus.com/bid/75393 · Nota
• http://thycotic.com/products/secret-server/resources/advisories/thy-ss-004 · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2015/Jun/78 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-3443 · Nota de Segurança