PT-2019-12042 · Iobroker · Iobroker.Web

Published 2019-11-25 · Updated 2019-12-04 · CVE-2019-10771

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions iobroker.web versions prior to 2.4.10

Description The issue arises from characters in the GET URL path not being properly escaped, which can be reflected in the server response. This can lead to Cross-Site Scripting, where attackers can execute arbitrary JavaScript in the victim's browser by exploiting the failure to escape URL parameters.

Recommendations Upgrade to version 2.4.10 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-10771

GHSA-6RJC-4PWR-3VP7

SNYK-JS-IOBROKERWEB-534971

Affected Products

Iobroker.Web

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-10771 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10771 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6rjc-4pwr-3vp7 · Vendor Advisory
• https://snyk.io/vuln/SNYK-JS-IOBROKERWEB-534971 · Note
• https://npmjs.com/advisories/1345 · Note