PT-2019-12283 · Ulicms · Ulicms

Kağan Eğlence · Publicado 2019-05-08 · Atualizado 2019-06-10 · CVE-2019-11398

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions UliCMS versions 2019.1 through 2019.2

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the go parameter to admin/index.php, the go parameter to /admin/index.php?register=register, or the error parameter to admin/index.php?action=favicon.

Recommendations For UliCMS version 2019.1, update to a version that contains a fix for this issue. For UliCMS version 2019.2, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the admin/index.php and /admin/index.php?register=register endpoints to minimize the risk of exploitation. Avoid using the go and error parameters in the affected API endpoints until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-11398

Produtos afetados

Ulicms

Referências · 6

• 🔥 https://exploit-db.com/exploits/46741 · Exploit
• 🔥 https://exploit-db.com/exploits/46977 · Exploit
• http://packetstormsecurity.com/files/153219/UliCMS-2019.1-Cross-Site-Scripting.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-11398 · Nota de Segurança
• https://en.ulicms.de · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-11398 · Aviso do Fabricante