PT-2019-12935 · Enttec · Enttec Datagate Mk2

Published 2019-06-07 · Updated 2019-06-10 · CVE-2019-12774

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ENTTEC Datagate Mk2 version 70044 update 05032019-482

Description A stored XSS issue has been identified in the web configuration feature, allowing an unauthenticated threat actor to inject malicious code into the application. This issue affects fields such as the Profile Description in JSON data sent to the Profile Editor.

Recommendations For ENTTEC Datagate Mk2 version 70044 update 05032019-482, consider restricting access to the web configuration feature until a fix is available, and avoid using the Profile Description field in the Profile Editor to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-12774

Affected Products

Enttec Datagate Mk2

References · 3

• 🔥 https://mogozobo.com/?p=3476 · Exploit
• https://osv.dev/vulnerability/CVE-2019-12774 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12774 · Security Note