PT-2018-15458 · Hsweb · Hsweb

Published 2018-12-30 · Updated 2019-01-15 · CVE-2018-20594

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions hsweb version 3.0.4

Description A reflected XSS issue was discovered due to the absence of type parameter checking in FlowableModelManagerController.java.

Recommendations For hsweb version 3.0.4, update the FlowableModelManagerController.java to include type parameter checking to prevent XSS exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-20594

GHSA-QQV6-5W6P-3PGR

Affected Products

Hsweb

References · 7

• 🔥 https://github.com/hs-web/hsweb-framework/issues/107 · Exploit
• https://github.com/hs-web/hsweb-framework/commit/b72a2275ed21240296c6539bae1049c56abb542f · Patch
• https://osv.dev/vulnerability/GHSA-qqv6-5w6p-3pgr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20594 · Security Note
• https://osv.dev/vulnerability/CVE-2018-20594 · Vendor Advisory
• https://github.com/hs-web/hsweb-framework · Note
• https://github.com/advisories/GHSA-qqv6-5w6p-3pgr · Note