PT-2017-6558 · Epicor · Epicor Crs Retail Store

Publicado 2017-09-06 · Atualizado 2018-10-09 · CVE-2015-2210

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Epicor CRS Retail Store versions prior to 3.2.03.01.008

Description The issue allows local users to execute arbitrary code by injecting Javascript into the help window source, enabling the creation of a button that spawns a command shell.

Recommendations For versions prior to 3.2.03.01.008, update to version 3.2.03.01.008 or later to resolve the issue.

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2015-2210

Produtos afetados

Epicor Crs Retail Store

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2015-2210 · Nota de Segurança
• http://packetstormsecurity.com/files/131732/Epicor-Retail-Store-Help-System-3.2.03.01.008-Code-Execution.html · Nota
• http://securityfocus.com/archive/1/535423/100/1000/threaded · Nota