PT-2019-5804 · D Link · D-Link Central Wifi Manager Cwm
Publicado
2019-07-06
·
Atualizado
2019-07-09
·
CVE-2019-13374
CVSS v2.0
6.4
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
D-Link Central WiFi Manager CWM(100) versions prior to v1.03R0100 BETA6
Description
A cross-site scripting (XSS) issue in the PayAction.class.php resource view allows remote attackers to inject arbitrary web script or HTML via the
passcode parameter in the "index.php/Pay/passcodeAuth" endpoint. This vulnerability is related to the lack of protection measures for the web page structure, which can be exploited by a remote attacker to inject malicious scripts or HTML code.Recommendations
For D-Link Central WiFi Manager CWM(100) versions prior to v1.03R0100 BETA6, update to version v1.03R0100 BETA6 or later to resolve the issue.
As a temporary workaround, consider restricting access to the "index.php/Pay/passcodeAuth" endpoint to minimize the risk of exploitation. Avoid using the
passcode parameter in this endpoint until the issue is resolved.Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
D-Link Central Wifi Manager Cwm