PT-2018-18892 · Open Audit · Open-Audit Professional

Tejesh Kolisetty · Published 2018-04-12 · Updated 2018-05-16 · CVE-2018-9155

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Open-AudIT Professional version 2.1.1

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component. This is demonstrated in the Admin->Logs section with a logs?logs.type= URI and the Manage->Attributes section via the Name (display) field to the attributes/create URI.

Recommendations For Open-AudIT Professional version 2.1.1, consider restricting access to the Admin->Logs and Manage->Attributes sections until a patch is available. As a temporary workaround, avoid using crafted names of components in these sections to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-9155

Affected Products

Open-Audit Professional

References · 4

• 🔥 https://exploit-db.com/exploits/44612 · Exploit
• 🔥 https://docs.google.com/document/d/1ZG1qiwpECbVnv92yNckDn7yyuluKoC2_ON-eLhAY97Q/edit?usp=sharing · Exploit
• https://osv.dev/vulnerability/CVE-2018-9155 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-9155 · Security Note