PT-2019-10153 · Haulmont · Cuba Platform+1

Bernatgs · Published 2019-01-03 · Updated 2022-05-14 · CVE-2018-20663

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: CUBA Platform versions prior to 6.10.x The Reporting Addon (aka Reports Addon) versions through 2019-01-02

Description: The issue concerns a Persistent XSS vulnerability. It can be exploited via the name field in the "Reports > Reports" section.

Recommendations: For The Reporting Addon (aka Reports Addon) versions through 2019-01-02, consider restricting access to the "Reports > Reports" name field until a fix is available. For CUBA Platform versions prior to 6.10.x, update to a version that includes the fix for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-20663

GHSA-RFF7-964G-PPPX

Affected Products

Cuba Platform

The Reporting Addon

References · 9

• 🔥 https://github.com/cuba-platform/reports/issues/140 · Exploit
• https://osv.dev/vulnerability/CVE-2018-20663 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rff7-964g-pppx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20663 · Security Note
• https://github.com/cuba-platform/cuba/commit/e9f972beeae42dc6dbc3aaa6b6ecc9814c0eedb4 · Note
• https://github.com/cuba-platform/cuba/issues/1741 · Note
• https://github.com/cuba-platform/cuba/commit/ec8784d8f596aa570604f4e5d5d4a7c3ae264c62 · Note
• https://github.com/cuba-platform/cuba/commit/be6aa41ff36a365e2a995d37861e5acfcd32c2c5 · Note
• https://github.com/cuba-platform/reports · Note