PT-2019-12447 · Oneshield · Oneshield Policy

Josh Sheppard · Published 2019-05-08 · Updated 2019-05-08 · CVE-2019-11643

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OneShield Policy (Dragon Core) versions prior to 5.1.10

Description A persistent XSS issue has been identified, allowing remote adversaries to inject malicious JavaScript into textboxes decorated with type string. This malicious code is stored in the applicable data store and can be exploited remotely by both authenticated and unauthenticated users.

Recommendations For versions prior to 5.1.10, update to version 5.1.10 or later to resolve the issue. As a temporary workaround, consider restricting access to textboxes that allow string input to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-11643

Affected Products

Oneshield Policy

References · 4

• https://osv.dev/vulnerability/CVE-2019-11643 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11643 · Security Note
• https://oneshield.com/business-solutions/oneshield-pc-solutions/oneshield-policy · Note
• http://seclists.org/fulldisclosure/2019/May/2 · Note