PT-2014-5807 · Epicor · Epicor Enterprise

Published 2014-10-10 · Updated 2017-08-29 · CVE-2014-4312

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Epicor Enterprise version 7.4 before FS74SP6 HotfixTL054181

Description The issue allows remote attackers to inject arbitrary web script or HTML via several sections and parameters, including the Notes section to Order details, the Description section to "Order to consume", the Favorites name section to Favorites, the FiltKeyword parameter to "Procurement/EKPHTML/search item bt.asp", the Act parameter to "Procurement/EKPHTML/EnterpriseManager/Budget/ImportBudget fr.asp", the hdnOpener or hdnApproverFieldName parameter to "Procurement/EKPHTML/EnterpriseManager/UserSearchDlg.asp", or the INTEGRATED parameter to "Procurement/EKPHTML/EnterpriseManager/Codes.asp".

Recommendations For Epicor Enterprise version 7.4 before FS74SP6 HotfixTL054181, apply the FS74SP6 HotfixTL054181 patch to resolve the issue. As a temporary workaround, consider restricting access to the affected API endpoints and parameters, such as "Procurement/EKPHTML/search item bt.asp", "Procurement/EKPHTML/EnterpriseManager/Budget/ImportBudget fr.asp", "Procurement/EKPHTML/EnterpriseManager/UserSearchDlg.asp", and "Procurement/EKPHTML/EnterpriseManager/Codes.asp", until the patch is applied. Avoid using the FiltKeyword, Act, hdnOpener, hdnApproverFieldName, and INTEGRATED parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-4312

Affected Products

Epicor Enterprise

References · 14

• 🔥 https://exploit-db.com/exploits/34864 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Oct/2 · Exploit
• 🔥 http://packetstormsecurity.com/files/128511/Epicor-Password-Disclosure-Cross-Site-Scripting.html · Exploit
• 🔥 http://securityfocus.com/bid/70192 · Exploit
• 🔥 http://exploit-db.com/exploits/34864 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-4312 · Security Note
• http://osvdb.org/show/osvdb/112471 · Note
• http://osvdb.org/show/osvdb/112465 · Note
• http://osvdb.org/show/osvdb/112470 · Note
• http://osvdb.org/show/osvdb/112469 · Note
• http://osvdb.org/show/osvdb/112464 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96793 · Note
• http://osvdb.org/show/osvdb/112467 · Note
• http://osvdb.org/show/osvdb/112466 · Note