PT-2019-18694 · Prima Systems · Flexair

Gjoko Krstic · CVE-2019-7671 · Publicado 2019-06-05 · Atualizado 2022-10-25

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Prima Systems FlexAir versions 2.3.38 and prior

Description The issue arises from parameters sent to scripts not being properly sanitized before being returned to the user. This may allow an attacker to execute arbitrary code in a user’s browser session in the context of an affected site.

Recommendations For versions 2.3.38 and prior, update to a version later than 2.3.38 to resolve the issue. At the moment, there is no information about other specific mitigation measures for this issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-7671

Produtos afetados

Flexair

Referências · 8

• 🔥 https://exploit-db.com/exploits/47633 · Exploit
• 🔥 http://packetstormsecurity.com/files/155274/Prima-Access-Control-2.3.35-Cross-Site-Scripting.html · Exploit
• https://applied-risk.com/resources/ar-2019-007 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-7671 · Nota de Segurança
• https://applied-risk.com/labs/advisories · Nota
• https://osv.dev/vulnerability/CVE-2019-7671 · Aviso do Fabricante
• https://applied-risk.com/index.php/download_file/view/199/165 · Nota
• https://us-cert.gov/ics/advisories/icsa-19-211-02 · Nota