PT-2017-18693 · Kodak · Kodak Insite

Published 2017-11-14 · Updated 2017-11-30 · CVE-2017-9085

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kodak InSite versions 6.5 through 8.0

Description The issue allows remote attackers to inject arbitrary web script. This can be achieved via the paramFile parameter to "/Site/Troubleshooting/DiagnosticReport.asp" or "/Site/Troubleshooting/SpeedTest.asp" API endpoints.

Recommendations For Kodak InSite versions 6.5 through 8.0, consider disabling access to the "/Site/Troubleshooting/DiagnosticReport.asp" and "/Site/Troubleshooting/SpeedTest.asp" API endpoints until a patch is available. Restrict the use of the paramFile parameter in these endpoints to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-9085

Affected Products

Kodak Insite

References · 3

• 🔥 https://packetstormsecurity.com/files/142587/Kodak-InSite-8.0-Cross-Site-Scripting.html · Exploit
• https://osv.dev/vulnerability/CVE-2017-9085 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9085 · Security Note