PT-2019-14630 · Nch · Nch Express Accounts Accounting

Publicado 2019-10-17 · Atualizado 2019-10-21 · CVE-2019-16330

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NCH Express Accounts Accounting version 7.02

Description The issue concerns a persistent cross-site scripting (XSS) flaw in the input fields for Invoices, Sales Orders, Items, Customers, and Quotes. An authenticated, unprivileged user can modify these fields to inject arbitrary JavaScript code.

Recommendations For NCH Express Accounts Accounting version 7.02, consider restricting access to the input fields for Invoices, Sales Orders, Items, Customers, and Quotes to prevent arbitrary JavaScript injection until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-16330

Produtos afetados

Nch Express Accounts Accounting

Referências · 3

• 🔥 https://exploit-db.com/exploits/47505 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-16330 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-16330 · Aviso do Fabricante