PT-2019-12082 · Roundup · Roundup

Hanno Böck · Publicado 2019-04-06 · Atualizado 2019-04-09 · CVE-2019-10904

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Roundup version 1.6

Description The issue allows for XSS via the URI due to mishandling of 404 errors by frontends/roundup.cgi and roundup/cgi/wsgi handler.py.

Recommendations For Roundup version 1.6, consider updating to a newer version that addresses this issue, or as a temporary workaround, restrict access to the vulnerable frontend and backend scripts to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-10904

DLA-1750-1

GHSA-926Q-WXR6-3CRQ

PYSEC-2019-201

Produtos afetados

Roundup

Referências · 19

• 🔥 https://github.com/python/bugs.python.org/issues/34 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2019/04/07/1 · Exploit
• 🔥 https://bugs.python.org/issue36391 · Exploit
• https://github.com/pypa/advisory-database/tree/main/vulns/roundup/PYSEC-2019-201.yaml · Nota
• https://github.com/roundup-tracker/roundup · Nota
• https://openwall.com/lists/oss-security/2019/04/05/1 · Nota
• https://osv.dev/vulnerability/CVE-2019-10904 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-10904 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-926q-wxr6-3crq · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2019-201 · Aviso do Fabricante
• https://bitbucket.org/python/roundup/commits/51682dc2cd7e28421d749117c25bec58f632ee5f · Nota
• https://github.com/advisories/GHSA-926q-wxr6-3crq · Nota
• https://issues.roundup-tracker.org/issue2551035 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10904 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2019/04/msg00009.html · Nota