PT-2019-15087 · Clipsoft · Clipsoft Rexpert

Published 2019-10-30 · Updated 2019-11-01 · CVE-2019-17324

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ClipSoft REXPERT versions 1.0.0.527 and earlier

Description The issue allows directory traversal through a special HTTP POST request with ../ characters, potentially leading to the creation of malicious HTML files by injecting crafted template content. User interaction is required, where the target must visit a malicious web page to exploit this issue.

Recommendations For ClipSoft REXPERT versions 1.0.0.527 and earlier, consider restricting access to the HTTP POST request endpoint to minimize the risk of exploitation until a fix is available. As a temporary workaround, avoid using the ../ characters in the HTTP POST requests to prevent directory traversal.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-17324

Affected Products

Clipsoft Rexpert

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-17324 · Security Note
• https://osv.dev/vulnerability/CVE-2019-17324 · Vendor Advisory
• https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35184 · Note