PT-2018-14510 · Serverscheck · Serverscheck Monitoring

Publicado 2018-10-24 · Atualizado 2018-12-06 · CVE-2018-18551

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ServersCheck Monitoring Software versions prior to 14.3.4

Description The issue concerns the presence of Persistent and Reflected XSS in the software. This can be exploited via several parameters, including status, type, device, location, group, and query in various HTML files such as sensors.html, report.html, group delete.html, and report save.html.

Recommendations For versions prior to 14.3.4, update to version 14.3.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable parameters status, type, device, location, group, and query in the affected HTML files until a patch is available. Avoid using these parameters in the "sensors.html", "report.html", "group delete.html", and "report save.html" files until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-18551

Produtos afetados

Serverscheck Monitoring

Referências · 4

• 🔥 http://hyp3rlinx.altervista.org/advisories/CVE-2018-18551-SERVERSCHECK-MONITORING-SOFTWARE-CROSS-SITE-SCRIPTING.txt · Exploit
• 🔥 http://packetstormsecurity.com/files/149914/ServersCheck-Monitoring-Software-14.3.3-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-18551 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-18551 · Aviso do Fabricante