PT-2023-12285 · Gurock · Gurock Testrail

Miglen · Publicado 2023-02-03 · Atualizado 2023-02-09 · CVE-2021-36538

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Gurock TestRail versions prior to 7.1.2

Description The issue allows remote authenticated attackers to run arbitrary code via the reference field in milestones or description fields in reports. This is a Cross Site Scripting (XSS) issue.

Recommendations For versions prior to 7.1.2, update to version 7.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the reference field in milestones and description fields in reports to minimize the risk of exploitation. Avoid using these fields until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2021-36538

Produtos afetados

Gurock Testrail

Referências · 4

• 🔥 https://gist.github.com/miglen/b09498b4b9fe1be58973bd474af125ab · Exploit
• https://t.me/cibsecurity/57495 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2021-36538 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2021-36538 · Aviso do Fabricante