PT-2018-11461 · Cyberark · Cyberark Endpoint Privilege Manager

Code16 · Publicado 2018-06-26 · Atualizado 2018-08-30 · CVE-2018-12903

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CyberArk Endpoint Privilege Manager version 10.2.1.603

Description The issue concerns a persistent XSS vulnerability. It can be triggered via an account name on the create token screen, the VfManager.asmx SelectAccounts->DisplayName screen, a user's groups in ConfigurationPage, the Dialog Title field, and App Group Name in the Application Group Wizard.

Recommendations For version 10.2.1.603, consider restricting access to the create token screen, VfManager.asmx, ConfigurationPage, and Application Group Wizard until a patch is available. As a temporary workaround, avoid using potentially malicious account names, DisplayNames, group names, Dialog Titles, and App Group Names in the affected screens and wizards. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-12903

Produtos afetados

Cyberark Endpoint Privilege Manager

Referências · 3

• 🔥 http://code610.blogspot.com/2018/06/exploiting-cyberark-1021603.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-12903 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-12903 · Aviso do Fabricante