PT-2019-15555 · Avast · Avast Antivirus

Yokokho · Published 2019-11-01 · Updated 2019-11-06 · CVE-2019-18653

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Avast AntiVirus versions 19.3.2369 build 19.3.4241.440

Description A Cross Site Scripting (XSS) issue exists in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name.

Recommendations For Avast AntiVirus version 19.3.2369 build 19.3.4241.440, consider disabling the Network Notification Popup feature until a patch is available to prevent potential exploitation of the XSS issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-18653

Affected Products

Avast Antivirus

References · 5

• 🔥 http://firstsight.me/2019/10/5000-usd-xss-issue-at-avast-desktop-antivirus-for-windows-yes-desktop · Exploit
• 🔥 https://medium.com/@YoKoKho/5-000-usd-xss-issue-at-avast-desktop-antivirus-for-windows-yes-desktop-1e99375f0968 · Exploit
• https://osv.dev/vulnerability/CVE-2019-18653 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18653 · Security Note
• https://medium.com/%40YoKoKho/5-000-usd-xss-issue-at-avast-desktop-antivirus-for-windows-yes-desktop-1e99375f0968 · Note