PT-2017-12552 · Socusoft · Socusoft Flash Slideshow Maker Professional

Publicado 2017-08-05 · Atualizado 2020-08-19 · CVE-2017-12439

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SocuSoft Flash Slideshow Maker Professional versions prior to v5.21

Description The issue arises when the advanced configuration is used, and the xml path HTTP parameter trusts user-supplied input. This is compounded by an unsafe XML configuration file, leading to content forgery, cross-site scripting, and unvalidated redirection issues. The xml path parameter is vulnerable to user input, which can be exploited.

Recommendations For SocuSoft Flash Slideshow Maker Professional versions prior to v5.21, as a temporary workaround, consider restricting access to the xml path HTTP parameter to minimize the risk of exploitation. Avoid using the xml path parameter in the affected configuration until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2017-12439

Produtos afetados

Socusoft Flash Slideshow Maker Professional

Referências · 3

• 🔥 https://packetstormsecurity.com/files/143542/Flash-Slideshow-Maker-Professional-XSS-Content-Forgery-Redirect.html · Exploit
• https://osv.dev/vulnerability/CVE-2017-12439 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-12439 · Nota de Segurança