PT-2019-12974 · Ht2 · Learning Locker

Publicado 2019-07-16 · Atualizado 2019-10-09 · CVE-2019-12834

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AC:L/AV:N/A:L/C:L/I:L/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions HT2 Labs Learning Locker version 3.15.1

Description The issue allows for the injection of malicious HTML and JavaScript code into the website's DOM via the PATH INFO to the "dashboards/" URI.

Recommendations For HT2 Labs Learning Locker version 3.15.1, consider restricting access to the dashboards/ URI until a patch is available. As a temporary workaround, avoid using the PATH INFO to the dashboards/ URI to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-12834

Produtos afetados

Learning Locker

Referências · 3

• 🔥 https://github.com/miruser/Roche-CVEs/blob/master/CVE-2019-12834.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12834 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-12834 · Aviso do Fabricante