PT-2019-12447 · Oneshield · Oneshield Policy

Josh Sheppard · Publicado 2019-05-08 · Atualizado 2019-05-08 · CVE-2019-11643

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OneShield Policy (Dragon Core) versions prior to 5.1.10

Description A persistent XSS issue has been identified, allowing remote adversaries to inject malicious JavaScript into textboxes decorated with type string. This malicious code is stored in the applicable data store and can be exploited remotely by both authenticated and unauthenticated users.

Recommendations For versions prior to 5.1.10, update to version 5.1.10 or later to resolve the issue. As a temporary workaround, consider restricting access to textboxes that allow string input to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-11643

Produtos afetados

Oneshield Policy

Referências · 4

• https://osv.dev/vulnerability/CVE-2019-11643 · Aviso do Fabricante
• https://oneshield.com/business-solutions/oneshield-pc-solutions/oneshield-policy · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-11643 · Nota de Segurança
• http://seclists.org/fulldisclosure/2019/May/2 · Nota