PT-2015-6230 · Thycotic · Thycotic Secret Server

Marco Delai · Published 2015-07-02 · Updated 2018-10-09 · CVE-2015-3443

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Thycotic Secret Server versions 8.6.x through 8.8.x before 8.8.000005

Description A cross-site scripting (XSS) issue exists in the basic dashboard, allowing remote authenticated users to inject arbitrary web script or HTML via a password entry. This occurs because the password entry is not properly handled when toggling the password mask.

Recommendations For Thycotic Secret Server versions 8.6.x through 8.8.x before 8.8.000005, update to version 8.8.000005 or later to resolve the issue. As a temporary workaround, consider restricting access to the basic dashboard to minimize the risk of exploitation. Avoid using the password entry feature in the affected dashboard until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-3443

Affected Products

Thycotic Secret Server

References · 7

• 🔥 https://exploit-db.com/exploits/37394 · Exploit
• 🔥 http://csnc.ch/misc/files/advisories/CVE-2015-3443_Thycotic_Secret_Server_XSS.TXT · Exploit
• http://thycotic.com/products/secret-server/resources/advisories/thy-ss-004 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-3443 · Security Note
• http://securityfocus.com/archive/1/535821/100/0/threaded · Note
• http://securityfocus.com/bid/75393 · Note
• http://seclists.org/fulldisclosure/2015/Jun/78 · Note