PT-2018-17625 · Ipswitch · Ipswitch Moveit

Publicado 2018-02-02 · Atualizado 2018-02-14 · CVE-2018-6545

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ipswitch MoveIt version 8.1

Description The issue allows attackers to leverage a Stored Cross-Site Scripting (XSS) vulnerability, as demonstrated by the "human.aspx" endpoint, to send malicious messages to other users. This can lead to the theft of session cookies and the launch of client-side attacks.

Recommendations For Ipswitch MoveIt version 8.1, consider disabling access to the "human.aspx" endpoint as a temporary workaround until a patch is available. Restrict the ability for users to send messages that may contain malicious scripts to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-6545

Produtos afetados

Ipswitch Moveit

Referências · 3

• 🔥 https://crowdshield.com/blog.php?name=ipswitch-moveit-stored-xss · Exploit
• https://osv.dev/vulnerability/CVE-2018-6545 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-6545 · Nota de Segurança