PT-2018-14510 · Serverscheck · Serverscheck Monitoring

Published 2018-10-24 · Updated 2018-12-06 · CVE-2018-18551

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ServersCheck Monitoring Software versions prior to 14.3.4

Description The issue concerns the presence of Persistent and Reflected XSS in the software. This can be exploited via several parameters, including status, type, device, location, group, and query in various HTML files such as sensors.html, report.html, group delete.html, and report save.html.

Recommendations For versions prior to 14.3.4, update to version 14.3.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable parameters status, type, device, location, group, and query in the affected HTML files until a patch is available. Avoid using these parameters in the "sensors.html", "report.html", "group delete.html", and "report save.html" files until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-18551

Affected Products

Serverscheck Monitoring

References · 4

• 🔥 http://hyp3rlinx.altervista.org/advisories/CVE-2018-18551-SERVERSCHECK-MONITORING-SOFTWARE-CROSS-SITE-SCRIPTING.txt · Exploit
• 🔥 http://packetstormsecurity.com/files/149914/ServersCheck-Monitoring-Software-14.3.3-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-18551 · Security Note
• https://osv.dev/vulnerability/CVE-2018-18551 · Vendor Advisory