PT-2014-8617 · Jexperts · Jexperts Channel Platform

Published 2014-11-13 · Updated 2017-09-08 · CVE-2014-8557

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions JExperts Channel Platform version 5.0.33 CCB

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the usuario.nome variable in an 'editarUsuario' action to 'usuario.do' or the titulo.form variable in a 'novoChamado' action to 'ticket.do'.

Recommendations For JExperts Channel Platform version 5.0.33 CCB, as a temporary workaround, consider restricting access to the 'usuario.do' and 'ticket.do' endpoints until a patch is available. Avoid using the usuario.nome and titulo.form variables in the affected actions until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-8557

Affected Products

Jexperts Channel Platform

References · 5

• 🔥 http://seclists.org/fulldisclosure/2014/Nov/9 · Exploit
• 🔥 http://packetstormsecurity.com/files/129009/JExperts-Tecnologia-Channel-Software-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-8557 · Security Note
• http://securityfocus.com/bid/70967 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98532 · Note