PT-2019-11433 · Openenergymonitor · Openenergymonitor Project Emoncms

Jna380 · Publicado 2019-07-15 · Atualizado 2019-07-18 · CVE-2019-1010008

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: OpenEnergyMonitor Project Emoncms version 9.8.8

Description: The issue concerns a Cross Site Scripting (XSS) problem. The impact is theoretically low but could potentially enable persistent XSS, allowing a user to embed malicious code. The component affected is the Javascript code execution in the "Name", "Location", "Bio", and "Starting Page" fields on the "My Account" page, specifically in the file Lib/listjs/list.js at line 67. The attack vector involves a victim opening their profile page if a persistent attack is possible.

Recommendations: For OpenEnergyMonitor Project Emoncms version 9.8.8, consider disabling the Javascript code execution in the "Name", "Location", "Bio", and "Starting Page" fields in the "My Account" page as a temporary workaround until a patch is available. Restrict access to the list.js file to minimize the risk of exploitation. Avoid using the fields in the "My Account" page that are vulnerable to XSS until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-1010008

Produtos afetados

Openenergymonitor Project Emoncms

Referências · 3

• 🔥 https://github.com/emoncms/emoncms/issues/763 · Exploit
• https://osv.dev/vulnerability/CVE-2019-1010008 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010008 · Nota de Segurança