PT-2019-15274 · Zucchetti · Zucchetti Infobusiness

Published 2019-10-30 · Updated 2019-11-01 · CVE-2019-18205

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zucchetti InfoBusiness versions prior to 4.4.1

Description The issue is related to Multiple Reflected Cross-site Scripting (XSS) vulnerabilities. The browsing component did not properly sanitize user input, which was encoded in base64. This vulnerability also affects the search functionality, specifically the searchKey parameter.

Recommendations For versions prior to 4.4.1, update to a version later than 4.4.1 to resolve the issue. As a temporary workaround, consider restricting the use of the browsing component and search functionality until a patch is available. Avoid using the searchKey parameter in the affected search functionality until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-18205

Affected Products

Zucchetti Infobusiness

References · 3

• 🔥 https://blog.hacktivesecurity.com/index.php?controller=post&action=view&id_post=42 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-18205 · Security Note
• https://osv.dev/vulnerability/CVE-2019-18205 · Vendor Advisory