PT-2019-14983 · Genesys · Genesys Pureengage Digital

Luis Eduardo Jácome V + 1 · Publicado 2019-10-11 · Atualizado 2019-10-16 · CVE-2019-17176

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Genesys PureEngage Digital (eServices) version 8.1.x

Description The issue allows for XSS attacks through specific JSP files, namely HtmlChatPanel.jsp or HtmlChatFrameSet.jsp, by manipulating certain parameters. These parameters include ActionColor, ClientNickNameColor, Email, email, or email address.

Recommendations For Genesys PureEngage Digital (eServices) version 8.1.x, consider restricting access to the HtmlChatPanel.jsp and HtmlChatFrameSet.jsp files until a patch is available. As a temporary workaround, avoid using the parameters ActionColor, ClientNickNameColor, Email, email, or email address in the affected API endpoints.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-17176

Produtos afetados

Genesys Pureengage Digital

Referências · 3

• 🔥 https://gist.github.com/MortalP0ison/5fd584b4c85fa13281fdc918913446fa · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-17176 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-17176 · Aviso do Fabricante