PT-2019-9450 · Kofax · Kofax Front Office Server

Drunkenshells · Publicado 2019-04-18 · Atualizado 2019-04-19 · CVE-2018-17288

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kofax Front Office Server version 4.1.1.11.0.5212

Description The issue concerns multiple authenticated stored XSS vulnerabilities. These can be exploited via the "Filename" field in the "/Kofax/KFS/ThinClient/document/upload/" endpoint for the Thin Client, or the "DeviceName" field in the "/Kofax/KFS/Admin/DeviceService/device/" endpoint for the Administration Console.

Recommendations For version 4.1.1.11.0.5212, consider disabling the upload functionality in the Thin Client and restricting access to the DeviceService in the Administration Console until a patch is available. Avoid using the "Filename" and "DeviceName" fields in the respective endpoints until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-17288

Produtos afetados

Kofax Front Office Server

Referências · 3

• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2018-17288-XSS-Kofax · Exploit
• https://osv.dev/vulnerability/CVE-2018-17288 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-17288 · Nota de Segurança