PT-2019-15364 · Ant Design · Ant Design Pro

Nstikhomirov · Publicado 2019-10-23 · Atualizado 2019-10-29 · CVE-2019-18350

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ant Design Pro version 4.0.0

Description The issue concerns a reflected XSS in the user/login redirect GET parameter, which affects the authorization component. This leads to the execution of JavaScript code in the login after-action script.

Recommendations For Ant Design Pro version 4.0.0, consider disabling the redirect parameter in the user/login endpoint until a patch is available. Restrict access to the authorization component to minimize the risk of exploitation. Avoid using the redirect GET parameter in the affected endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-18350

Produtos afetados

Ant Design Pro

Referências · 3

• 🔥 https://github.com/ant-design/ant-design-pro/pull/5461 · Exploit
• https://osv.dev/vulnerability/CVE-2019-18350 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-18350 · Nota de Segurança