PT-2019-12283 · Ulicms · Ulicms

Kağan Eğlence · Published 2019-05-08 · Updated 2019-06-10 · CVE-2019-11398

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions UliCMS versions 2019.1 through 2019.2

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the go parameter to admin/index.php, the go parameter to /admin/index.php?register=register, or the error parameter to admin/index.php?action=favicon.

Recommendations For UliCMS version 2019.1, update to a version that contains a fix for this issue. For UliCMS version 2019.2, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the admin/index.php and /admin/index.php?register=register endpoints to minimize the risk of exploitation. Avoid using the go and error parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-11398

Affected Products

Ulicms

References · 6

• 🔥 https://exploit-db.com/exploits/46741 · Exploit
• 🔥 https://exploit-db.com/exploits/46977 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-11398 · Security Note
• https://en.ulicms.de · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11398 · Vendor Advisory
• http://packetstormsecurity.com/files/153219/UliCMS-2019.1-Cross-Site-Scripting.html · Note