PT-2019-9624 · Semcosoft · Semcosoft

Pascal Keul + 1 · Publicado 2019-02-23 · Atualizado 2019-02-25 · CVE-2018-18692

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Semcosoft version 5.3

Description A reflected Cross-Site scripting issue allows remote attackers to inject arbitrary web scripts or HTML via the username parameter to the "Login Form" API endpoint.

Recommendations For Semcosoft version 5.3, consider validating and sanitizing user input for the username parameter in the Login Form to prevent arbitrary script injection. As a temporary workaround, restrict access to the Login Form until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-18692

Produtos afetados

Semcosoft

Referências · 3

• 🔥 https://atomic111.github.io/article/semcosoft-cross-site-scripting · Exploit
• https://osv.dev/vulnerability/CVE-2018-18692 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-18692 · Nota de Segurança