PT-2017-6702 · Qdpm · Qdpm

Ross Marks · Published 2017-03-17 · Updated 2017-03-20 · CVE-2015-3883

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions qdPM version 8.3

Description The issue allows remote attackers to inject arbitrary web script or HTML via several parameters, including the search[keywords] parameter to "index.php/users" page, the "Name of application" on "index.php/configuration", a new project name on "index.php/projects", the task name on "index.php/tasks", ticket name on "index.php/tickets", discussion name on "index.php/discussions", report name on "index.php/projectReports", or event name on "index.php/scheduler/personal".

Recommendations For qdPM version 8.3, consider restricting access to the mentioned API endpoints until a patch is available. As a temporary workaround, avoid using the vulnerable parameters, such as search[keywords], in the affected pages. Restrict input for the "Name of application", new project name, task name, ticket name, discussion name, report name, and event name fields to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-3883

Affected Products

Qdpm

References · 4

• 🔥 http://rossmarks.uk/whitepapers/qdPM_8.3.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-3883 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3883 · Note
• http://rossmarks.uk/portfolio.php · Note