PT-2023-13469 · Tcman Gim · Tcman Gim

Jorge Alberto Palma Reyes + 1 · Publicado 2023-10-04 · Atualizado 2023-10-06 · CVE-2022-36277

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions TCMAN GIM version 8.0.1

Description The issue concerns the sReferencia, sDescripcion, txtCodigo, and txtDescripcion parameters in the "frmGestionStock.aspx" and "frmEditServicio.aspx" files, which could allow an attacker to perform persistent XSS attacks.

Recommendations For TCMAN GIM version 8.0.1, consider restricting or sanitizing the input for the sReferencia, sDescripcion, txtCodigo, and txtDescripcion parameters in the affected files to prevent XSS attacks. As a temporary workaround, restrict access to the frmGestionStock.aspx and frmEditServicio.aspx files until a patch is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2022-36277

Produtos afetados

Tcman Gim

Referências · 4

• https://t.me/cibsecurity/71606 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-36277 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-36277 · Nota de Segurança
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcman-gim · Nota