PT-2019-11505 · Servicestack · Servicestack Framework

Published 2019-07-23 · Updated 2022-05-24 · CVE-2019-1010199

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: ServiceStack ServiceStack Framework versions prior to 5.2.0

Description: The issue allows JavaScript to be reflected in the server response, which is then executed by the browser. This is due to a lack of server-side validation and the potential for browser encoding to be bypassed. The component vulnerable to this issue is the query used in the GET request. When a victim opens a crafted URL, they can be affected.

Recommendations: For versions prior to 5.2.0, update to version 5.2.0 to resolve the issue. As a temporary workaround, consider implementing server-side validation for the query used in the GET request to minimize the risk of exploitation. Restrict access to crafted URLs to prevent the execution of malicious JavaScript code.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-1010199

GHSA-VCFC-9WCP-J623

Affected Products

Servicestack Framework

References · 5

• https://github.com/ServiceStack/ServiceStack/commit/a0e0d7de20f5d1712f1793f925496def4383c610 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010199 · Security Note
• https://osv.dev/vulnerability/GHSA-vcfc-9wcp-j623 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1010199 · Vendor Advisory
• https://github.com/ServiceStack/ServiceStack · Note