PT-2019-13339 · Sertek · Sertek Xpare

Published 2019-07-17 · Updated 2019-07-18 · CVE-2019-13448

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sertek Xpare version 3.67

Description An issue was discovered where the login form does not sanitize input data, allowing a malicious agent to exploit a vulnerable function and prepare an XSS payload to send to the product's clients.

Recommendations For Sertek Xpare version 3.67, consider disabling the login form functionality until a patch is available to prevent potential XSS attacks. Restrict access to the login form to minimize the risk of exploitation. Avoid using the login form with untrusted input data until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-13448

Affected Products

Sertek Xpare

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-13448 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13448 · Vendor Advisory
• https://cyberoo.com/2019/07/16/cyberoo-identifica-vulnerabilita-0day · Note