PT-2019-15274 · Zucchetti · Zucchetti Infobusiness

Publicado 2019-10-30 · Atualizado 2019-11-01 · CVE-2019-18205

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zucchetti InfoBusiness versions prior to 4.4.1

Description The issue is related to Multiple Reflected Cross-site Scripting (XSS) vulnerabilities. The browsing component did not properly sanitize user input, which was encoded in base64. This vulnerability also affects the search functionality, specifically the searchKey parameter.

Recommendations For versions prior to 4.4.1, update to a version later than 4.4.1 to resolve the issue. As a temporary workaround, consider restricting the use of the browsing component and search functionality until a patch is available. Avoid using the searchKey parameter in the affected search functionality until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-18205

Produtos afetados

Zucchetti Infobusiness

Referências · 3

• 🔥 https://blog.hacktivesecurity.com/index.php?controller=post&action=view&id_post=42 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-18205 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-18205 · Aviso do Fabricante