PT-2019-1690 · Palo Alto Networks · Expedition Migration Tool

Sayali Kukarni · Publicado 2019-03-04 · Atualizado 2019-03-27 · CVE-2019-1570

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Expedition Migration tool versions 1.1.8 and earlier

Description The issue allows an authenticated attacker to run arbitrary JavaScript or HTML in the LDAP server settings. This is due to a lack of protection for the web page structure. Exploitation of the issue may enable a remote attacker to execute arbitrary JavaScript or HTML code.

Recommendations For versions 1.1.8 and earlier, update to a version that addresses this issue, as no specific workaround is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2019-01284

CVE-2019-1570

Produtos afetados

Expedition Migration Tool

Referências · 7

• 🔥 https://tenable.com/security/research/tra-2019-13 · Exploit
• https://bdu.fstec.ru/vul/2019-01284 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-1570 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-1570 · Aviso do Fabricante
• http://securityfocus.com/bid/107564 · Nota
• https://securityadvisories.paloaltonetworks.com/Home/Detail/142 · Nota
• https://securityfocus.com/bid/107564 · Nota