PT-2023-22436 · Exelysis · Exelysis Unified Communication Solution

Publicado 2023-04-26 · Atualizado 2023-05-08 · CVE-2023-29836

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Exelysis Unified Communication Solutions (EUCS) version 1.0

Description A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via the Username parameter of the "eucsAdmin login form" API endpoint.

Recommendations For Exelysis Unified Communication Solutions (EUCS) version 1.0, consider disabling the Username parameter in the eucsAdmin login form until a patch is available. Restrict access to the eucsAdmin login form to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-29836

Produtos afetados

Exelysis Unified Communication Solution

Referências · 5

• 🔥 https://github.com/IthacaLabs/Exelysis · Exploit
• https://t.me/cibsecurity/62937 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-29836 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-29836 · Aviso do Fabricante
• https://github.com/IthacaLabs/Exelysis/blob/main/EUCS%20Admin%20Login%20XSS.txt · Nota