PT-2019-13339 · Sertek · Sertek Xpare

Publicado 2019-07-17 · Atualizado 2019-07-18 · CVE-2019-13448

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sertek Xpare version 3.67

Description An issue was discovered where the login form does not sanitize input data, allowing a malicious agent to exploit a vulnerable function and prepare an XSS payload to send to the product's clients.

Recommendations For Sertek Xpare version 3.67, consider disabling the login form functionality until a patch is available to prevent potential XSS attacks. Restrict access to the login form to minimize the risk of exploitation. Avoid using the login form with untrusted input data until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-13448

Produtos afetados

Sertek Xpare

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-13448 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-13448 · Aviso do Fabricante
• https://cyberoo.com/2019/07/16/cyberoo-identifica-vulnerabilita-0day · Nota