PT-2019-11424 · Apache · Apache Allura

Publicado 2019-06-18 · Atualizado 2019-06-19 · CVE-2019-10085

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Apache Allura versions prior to 1.11.0

Description: A stored XSS issue exists in the user dropdown selector when creating or editing tickets. The XSS executes when a user interacts with the dropdown on the affected page.

Recommendations: For versions prior to 1.11.0, update to version 1.11.0 or later to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-10085

Produtos afetados

Apache Allura

Referências · 5

• https://lists.apache.org/thread.html/9a20914c4251a2ae3caebd8d0dd0056f3ac89209d6c216bb89efabd9%40%3Cannounce.apache.org%3E · Nota
• https://lists.apache.org/thread.html/88c064c95da2f41d5435ca5b3e364925bed72cc73bcec9b3f25e4c07%40%3Cdev.allura.apache.org%3E · Nota
• https://osv.dev/vulnerability/CVE-2019-10085 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10085 · Nota de Segurança
• http://securityfocus.com/bid/108816 · Nota