PT-2019-13477 · Xhq · Xhq

Published 2019-12-12 · Updated 2019-12-19 · CVE-2019-13930

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions XHQ versions prior to 6.0.0.2

Description A security issue has been identified that could allow a Cross-Site Request Forgery (CSRF) attack if a user is tricked into accessing a malicious link. To be successful, the attack requires interaction from a legitimate user who is authenticated to the web interface. If exploited, an attacker could trigger actions via the web interface that the legitimate user is allowed to perform, potentially allowing the attacker to read or modify the contents of the web application. At the time of publication, no public exploitation of this issue was known.

Recommendations For versions prior to 6.0.0.2, update to version 6.0.0.2 or later to resolve the issue. As a temporary workaround, consider implementing additional authentication steps or validating requests to prevent unauthorized actions via the web interface. Restrict access to the web interface to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-13930

Affected Products

Xhq

References · 3

• https://osv.dev/vulnerability/CVE-2019-13930 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13930 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-525454.pdf · Vendor Advisory