PT-2017-12560 · Barco · Barco Clickshare Csc-1

Published 2017-10-30 · Updated 2017-11-18 · CVE-2017-12460

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Barco ClickShare CSM-1 versions prior to 1.7.0.3 Barco ClickShare CSC-1 versions prior to 1.10.0.10

Description An issue allows an authenticated user to trigger an HTML injection by uploading a wallpaper with a specially crafted name to the webUI, as special characters are not neutralized before output. This can potentially be used to manage the wallpaper collection shown as background on the ClickShare product.

Recommendations For Barco ClickShare CSM-1 versions prior to 1.7.0.3, update to version 1.7.0.3 or later. For Barco ClickShare CSC-1 versions prior to 1.10.0.10, update to version 1.10.0.10 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-12460

Affected Products

Barco Clickshare Csc-1

References · 5

• https://osv.dev/vulnerability/CVE-2017-12460 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12460 · Security Note
• https://barco.com/en/support/knowledge-base/KB5169 · Vendor Advisory
• https://barco.com/en/support/software/R33050020 · Vendor Advisory
• https://barco.com/en/Support/software/R33050037 · Vendor Advisory