PT-2017-18693 · Kodak · Kodak Insite

Publicado 2017-11-14 · Atualizado 2017-11-30 · CVE-2017-9085

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kodak InSite versions 6.5 through 8.0

Description The issue allows remote attackers to inject arbitrary web script. This can be achieved via the paramFile parameter to "/Site/Troubleshooting/DiagnosticReport.asp" or "/Site/Troubleshooting/SpeedTest.asp" API endpoints.

Recommendations For Kodak InSite versions 6.5 through 8.0, consider disabling access to the "/Site/Troubleshooting/DiagnosticReport.asp" and "/Site/Troubleshooting/SpeedTest.asp" API endpoints until a patch is available. Restrict the use of the paramFile parameter in these endpoints to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-9085

Produtos afetados

Kodak Insite

Referências · 3

• 🔥 https://packetstormsecurity.com/files/142587/Kodak-InSite-8.0-Cross-Site-Scripting.html · Exploit
• https://osv.dev/vulnerability/CVE-2017-9085 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-9085 · Nota de Segurança