PT-2019-15856 · Testlink · Testlink

Publicado 2019-12-02 · Atualizado 2020-01-20 · CVE-2019-19491

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TestLink version 1.9.19

Description The issue allows for XSS attacks through specific parameters and requests. This can be achieved via the edit parameter in lib/testcases/archiveData.php, the reqURI parameter in index.php, or the URI in a lib/testcases/tcEdit.php?doAction=doDeleteStep request.

Recommendations For TestLink version 1.9.19, as a temporary workaround, consider restricting access to the lib/testcases/archiveData.php and lib/testcases/tcEdit.php files, and avoid using the edit and reqURI parameters in index.php until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-19491

Produtos afetados

Testlink

Referências · 4

• 🔥 https://exploit-db.com/exploits/47702 · Exploit
• https://t.me/cvenotify/337 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2019-19491 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-19491 · Nota de Segurança