PT-2019-17067 · Hcl · Hcl Traveler

Publicado 2019-10-18 · Atualizado 2019-10-30 · CVE-2019-4409

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HCL Traveler versions 9.x and earlier

Description The issue concerns a cross-site scripting (XSS) vulnerability. Specifically, on the Problem Report page of the Traveler servlet pages, there is a field for specifying a file attachment to provide additional problem details. If an invalid file name is entered and the error message returned includes the file name without proper escaping, it could expose an XSS vulnerability.

Recommendations For HCL Traveler versions 9.x and earlier, ensure that file names entered for attachments on the Problem Report page are properly escaped in the returned error page to prevent XSS attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-4409

Produtos afetados

Hcl Traveler

Referências · 3

• https://hclpnpsupport.hcltech.com/csm?id=kb_article&sysparm_article=KB0073231 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-4409 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-4409 · Aviso do Fabricante