PT-2019-12042 · Iobroker · Iobroker.Web

Publicado 2019-11-25 · Atualizado 2019-12-04 · CVE-2019-10771

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions iobroker.web versions prior to 2.4.10

Description The issue arises from characters in the GET URL path not being properly escaped, which can be reflected in the server response. This can lead to Cross-Site Scripting, where attackers can execute arbitrary JavaScript in the victim's browser by exploiting the failure to escape URL parameters.

Recommendations Upgrade to version 2.4.10 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-10771

GHSA-6RJC-4PWR-3VP7

SNYK-JS-IOBROKERWEB-534971

Produtos afetados

Iobroker.Web

Referências · 5

• https://snyk.io/vuln/SNYK-JS-IOBROKERWEB-534971 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10771 · Nota de Segurança
• https://npmjs.com/advisories/1345 · Nota
• https://osv.dev/vulnerability/CVE-2019-10771 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-6rjc-4pwr-3vp7 · Aviso do Fabricante