PT-2018-9219 · Mcholste · Elsa

Jeffrey Medsger · Published 2018-02-09 · Updated 2018-03-08 · CVE-2018-1000029

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: mcholste Enterprise Log Search and Archive (ELSA) version revision 1205, commit 2cc17f1 and earlier

Description: The issue is related to a Cross Site Scripting (XSS) vulnerability in the index view (/) that can be exploited via payload delivered through specific parameters. The vulnerable parameters include type, name, and value in the "/Query/set preference" endpoint, and name and value in the "/Query/preference" endpoint. The payload is executed when a user visits the index view (/).

Recommendations: For mcholste Enterprise Log Search and Archive (ELSA) version revision 1205, commit 2cc17f1 and earlier, consider restricting access to the "/Query/set preference" and "/Query/preference" endpoints to minimize the risk of exploitation. As a temporary workaround, avoid using the type, name, and value parameters in the "/Query/set preference" endpoint and the name and value parameters in the "/Query/preference" endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-1000029

Affected Products

Elsa

References · 3

• https://osv.dev/vulnerability/CVE-2018-1000029 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000029 · Security Note
• http://blog.securityonion.net/2018/01/security-advisory-for-elsa.html · Note