PT-2023-19480 · Unknown · Control Id Rhid

Stux

·

Publicado

2023-04-29

·

Atualizado

2024-05-17

·

CVE-2023-2421

CVSS v3.1

6.1

Média

VetorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Control iD RHiD version 23.3.19.0
Description A problematic issue has been discovered, affecting an unknown function of the file /v2/#/add/department. The manipulation of the Name argument leads to cross-site scripting. This issue can be exploited remotely. The vendor was contacted about this disclosure but did not respond.
Recommendations For version 23.3.19.0, as a temporary workaround, consider restricting access to the /v2/#/add/department endpoint until a patch is available. Avoid using the Name argument in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-2421

Produtos afetados

Control Id Rhid