PT-2012-2048 · Sit! · Support Incident Tracker
Published
2012-01-29
·
Updated
2017-08-29
·
CVE-2011-5070
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Support Incident Tracker (aka SiT!) version 3.65
Description
The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The vulnerabilities are found in several areas, including the file name to incident attachments.php, unspecified vectors in link add.php, and unspecified vectors in translate.php. In link add.php, the issue possibly involves the
origref, linkref, linktype parameters, which are not properly handled in the clean int function, or the redirect parameter, which is not properly handled in the html redirect function.Recommendations
For Support Incident Tracker (aka SiT!) version 3.65, consider disabling the
clean int function in lib/base.inc.php and the html redirect function in lib/html.inc.php as a temporary workaround until a patch is available. Restrict access to the incident attachments.php, link add.php, and translate.php files to minimize the risk of exploitation. Avoid using the origref, linkref, linktype, and redirect parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Support Incident Tracker