PT-2007-4533 · Xythos · Xythos Digital Locker+1
Brian Reilly
·
Published
2007-06-27
·
Updated
2018-10-16
·
CVE-2007-3254
CVSS v2.0
3.5
Low
| Vector | AV:N/AC:M/Au:S/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Xythos Enterprise Document Manager (XEDM) versions 5.0.25.8 and earlier, and 6.x versions prior to 6.0.46.1
Xythos Digital Locker (XDL) versions 5.0.25.8 and earlier, and 6.x versions prior to 6.0.46.1
Description
The issue allows remote authenticated users to inject arbitrary web script or HTML via various means, including a saved Workflow name, a Workflow name related to deletion of a Workflow template, the Content-Type HTTP header, or the name of an uploaded file. This affects Xythos Enterprise Document Manager and Xythos Digital Locker.
Recommendations
For Xythos Enterprise Document Manager (XEDM) versions 5.0.25.8 and earlier, update to version 5.0.25.8 or later.
For Xythos Enterprise Document Manager (XEDM) 6.x versions prior to 6.0.46.1, update to version 6.0.46.1 or later.
For Xythos Digital Locker (XDL) versions 5.0.25.8 and earlier, update to version 5.0.25.8 or later.
For Xythos Digital Locker (XDL) 6.x versions prior to 6.0.46.1, update to version 6.0.46.1 or later.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Xythos Digital Locker
Xythos Enterprise Document Manager