PT-2019-15856 · Testlink · Testlink

Published 2019-12-02 · Updated 2020-01-20 · CVE-2019-19491

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TestLink version 1.9.19

Description The issue allows for XSS attacks through specific parameters and requests. This can be achieved via the edit parameter in lib/testcases/archiveData.php, the reqURI parameter in index.php, or the URI in a lib/testcases/tcEdit.php?doAction=doDeleteStep request.

Recommendations For TestLink version 1.9.19, as a temporary workaround, consider restricting access to the lib/testcases/archiveData.php and lib/testcases/tcEdit.php files, and avoid using the edit and reqURI parameters in index.php until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-19491

Affected Products

Testlink

References · 4

• 🔥 https://exploit-db.com/exploits/47702 · Exploit
• https://osv.dev/vulnerability/CVE-2019-19491 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19491 · Security Note
• https://t.me/cvenotify/337 · Telegram Post