PT-2019-14611 · Nch · Nch Express Invoice

Publicado 2019-10-14 · Atualizado 2019-10-16 · CVE-2019-16282

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NCH Express Invoice version 7.12

Description The issue concerns a persistent cross-site scripting (XSS) flaw. This flaw can be exploited via the input fields for Invoices, Items, Customers, and Quotes. An authenticated, unprivileged user can modify these fields to inject arbitrary JavaScript code.

Recommendations For NCH Express Invoice version 7.12, consider restricting access to the input fields for Invoices, Items, Customers, and Quotes to prevent arbitrary JavaScript injection until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-16282

Produtos afetados

Nch Express Invoice

Referências · 3

• 🔥 https://exploit-db.com/exploits/47496 · Exploit
• https://osv.dev/vulnerability/CVE-2019-16282 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-16282 · Nota de Segurança