PT-2025-6945 · Enituretechnology · Enituretechnology Ltl Freight Quotes – Worldwide Express Edition
Trương Hữu Phúc
·
Publicado
2025-02-16
·
Atualizado
2025-02-18
·
CVE-2025-22286
CVSS v3.1
7.1
Alta
| Vetor | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions:
enituretechnology LTL Freight Quotes – Worldwide Express Edition versions n/a through 5.0.21
Description:
The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting (XSS). This enables attackers to inject malicious scripts into websites, potentially leading to unauthorized access or data theft. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.
Recommendations:
For versions n/a through 5.0.21, update to a version later than 5.0.21 to resolve the issue. As a temporary workaround, consider restricting access to sensitive pages or inputs that may be vulnerable to Cross-site Scripting attacks until a patch is available. Avoid using potentially vulnerable API endpoints or parameters that may be susceptible to XSS attacks. At the moment, there is no additional information about other mitigation measures.
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Enituretechnology Ltl Freight Quotes – Worldwide Express Edition