PT-2019-13031 · Seeddms · Seeddms

Published 2019-06-28 · Updated 2019-07-03 · CVE-2019-12932

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SeedDMS version 5.1.11

Description A stored XSS issue was found due to poorly escaping the search result in the autocomplete search form. This form is located in the header of out/out.Viewfolder.php.

Recommendations For SeedDMS version 5.1.11, consider disabling the autocomplete search form in out/out.Viewfolder.php until a patch is available to properly escape search results and prevent XSS exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-12932

Affected Products

Seeddms

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-12932 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12932 · Vendor Advisory
• https://sourceforge.net/p/seeddms/code/ci/seeddms-5.1.x/tree/CHANGELOG · Note