PT-2019-13506 · Ovidentia · Ovidentia

Fernando Pinheiro + 3 · Published 2019-07-19 · Updated 2019-07-27 · CVE-2019-13977

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ovidentia version 8.4.3

Description The issue concerns a problem with index.php in Ovidentia, where there is a possibility of XSS via several specific parameters. The affected parameters include tg=groups, tg=maildoms&idx=create&userid=0&bgrp=y, tg=delegat, tg=site&idx=create, tg=site&item=4, tg=admdir&idx=mdb&id=1, tg=notes&idx=Create, tg=admfaqs&idx=Add, and tg=admoc&idx=addoc&item=.

Recommendations For Ovidentia version 8.4.3, consider restricting access to the vulnerable index.php file until a patch is available. As a temporary workaround, avoid using the specified parameters in the index.php file to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-13977

Affected Products

Ovidentia

References · 5

• 🔥 https://github.com/Kitsun3Sec/exploits/blob/master/cms/ovidentia/exploitXSSOvidentia.txt · Exploit
• 🔥 https://exploit-db.com/exploits/47159 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-13977 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13977 · Vendor Advisory
• http://packetstormsecurity.com/files/153737/Ovidentia-8.4.3-Cross-Site-Scripting.html · Note