PT-2019-12935 · Enttec · Enttec Datagate Mk2

Publicado 2019-06-07 · Atualizado 2019-06-10 · CVE-2019-12774

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ENTTEC Datagate Mk2 version 70044 update 05032019-482

Description A stored XSS issue has been identified in the web configuration feature, allowing an unauthenticated threat actor to inject malicious code into the application. This issue affects fields such as the Profile Description in JSON data sent to the Profile Editor.

Recommendations For ENTTEC Datagate Mk2 version 70044 update 05032019-482, consider restricting access to the web configuration feature until a fix is available, and avoid using the Profile Description field in the Profile Editor to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-12774

Produtos afetados

Enttec Datagate Mk2

Referências · 3

• 🔥 https://mogozobo.com/?p=3476 · Exploit
• https://osv.dev/vulnerability/CVE-2019-12774 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-12774 · Nota de Segurança