PT-2019-15298 · Reliable Controls · Mach-Prowebcom/Sys

Gjoko Krstic · Published 2019-12-24 · Updated 2020-01-07 · CVE-2019-18249

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Reliable Controls MACH-ProWebCom/Sys versions prior to 2.15 (Firmware versions prior to 8.26.4)

Description The issue allows an attacker to execute commands on behalf of the user when an authenticated user clicks on a malicious link.

Recommendations For versions prior to 2.15 (Firmware versions prior to 8.26.4), update to version 2.15 or later (Firmware version 8.26.4 or later) to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-18249

Affected Products

Mach-Prowebcom/Sys

References · 3

• https://us-cert.gov/ics/advisories/icsa-19-353-04 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-18249 · Security Note
• https://osv.dev/vulnerability/CVE-2019-18249 · Vendor Advisory