PT-2014-4023 · Rexx · Rexx Recruitment

Published 2014-10-06 · Updated 2018-10-09 · CVE-2014-1224

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions rexx Recruitment versions R6.1 through R7 without fixes from 2014-01-15

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via the oninput event handler in the fname parameter to the default URI in "/reg".

Recommendations For versions R6.1 through R7 without fixes from 2014-01-15, apply the fixes from 2014-01-15 to resolve the issue. As a temporary workaround, consider restricting access to the user registration feature or disabling the oninput event handler in the fname parameter to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-1224

Affected Products

Rexx Recruitment

References · 5

• 🔥 https://redteam-pentesting.de/en/advisories/rt-sa-2014-002/-rexx-recruitment-cross-site-scripting-in-user-registration · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Mar/389 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-1224 · Security Note
• http://secunia.com/advisories/56310 · Note
• http://securityfocus.com/archive/1/531654/100/0/threaded · Note