PT-2019-11505 · Servicestack · Servicestack Framework

Publicado 2019-07-23 · Atualizado 2022-05-24 · CVE-2019-1010199

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: ServiceStack ServiceStack Framework versions prior to 5.2.0

Description: The issue allows JavaScript to be reflected in the server response, which is then executed by the browser. This is due to a lack of server-side validation and the potential for browser encoding to be bypassed. The component vulnerable to this issue is the query used in the GET request. When a victim opens a crafted URL, they can be affected.

Recommendations: For versions prior to 5.2.0, update to version 5.2.0 to resolve the issue. As a temporary workaround, consider implementing server-side validation for the query used in the GET request to minimize the risk of exploitation. Restrict access to crafted URLs to prevent the execution of malicious JavaScript code.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-1010199

GHSA-VCFC-9WCP-J623

Produtos afetados

Servicestack Framework

Referências · 5

• https://github.com/ServiceStack/ServiceStack/commit/a0e0d7de20f5d1712f1793f925496def4383c610 · Correção
• https://github.com/ServiceStack/ServiceStack · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010199 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-vcfc-9wcp-j623 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-1010199 · Aviso do Fabricante