PT-2019-13367 · Sitecore · Sitecore

Publicado 2019-07-17 · Atualizado 2019-07-18 · CVE-2019-13493

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sitecore version 9.0 rev 171002

Description The issue exists in the Media Library and File Manager of the affected software, where an authenticated unprivileged user can inject arbitrary JavaScript by modifying the uploaded file extension parameter, resulting in a Persistent XSS condition.

Recommendations For Sitecore version 9.0 rev 171002, consider restricting access to the Media Library and File Manager to minimize the risk of exploitation until a patch is available. Avoid using the file extension parameter in the affected modules until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-13493

Produtos afetados

Sitecore

Referências · 4

• 🔥 https://exploit-db.com/exploits/47106 · Exploit
• 🔥 http://packetstormsecurity.com/files/153613/Sitecore-9.0-Rev-171002-Cross-Site-Scripting.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-13493 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-13493 · Nota de Segurança