PT-2018-15458 · Hsweb · Hsweb

Publicado 2018-12-30 · Atualizado 2019-01-15 · CVE-2018-20594

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions hsweb version 3.0.4

Description A reflected XSS issue was discovered due to the absence of type parameter checking in FlowableModelManagerController.java.

Recommendations For hsweb version 3.0.4, update the FlowableModelManagerController.java to include type parameter checking to prevent XSS exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-20594

GHSA-QQV6-5W6P-3PGR

Produtos afetados

Hsweb

Referências · 7

• 🔥 https://github.com/hs-web/hsweb-framework/issues/107 · Exploit
• https://github.com/hs-web/hsweb-framework/commit/b72a2275ed21240296c6539bae1049c56abb542f · Correção
• https://github.com/hs-web/hsweb-framework · Nota
• https://osv.dev/vulnerability/GHSA-qqv6-5w6p-3pgr · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-20594 · Nota de Segurança
• https://github.com/advisories/GHSA-qqv6-5w6p-3pgr · Nota
• https://osv.dev/vulnerability/CVE-2018-20594 · Aviso do Fabricante