PT-2017-11445 · Simplerisk · Simplerisk

Publicado 2017-07-24 · Atualizado 2017-08-10 · CVE-2017-10711

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SimpleRisk version 20170614-001

Description A CSRF attack on the 'reset.php' endpoint, specifically the Send Password Reset Email form, can insert XSS sequences via the user parameter.

Recommendations For version 20170614-001, consider disabling the Send Password Reset Email form temporarily until a patch is available to prevent CSRF attacks that could lead to XSS sequence insertion. Restrict access to the 'reset.php' endpoint to minimize the risk of exploitation. Avoid using the user parameter in the affected form until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-10711

Produtos afetados

Simplerisk

Referências · 4

• 🔥 https://youtube.com/watch?v=jOUKEYW0RQw · Exploit
• 🔥 https://seekurity.com/blog/general/reflected-xss-vulnerability-in-simplerisk · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-10711 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-10711 · Aviso do Fabricante