PT-2019-1690 · Palo Alto Networks · Expedition Migration Tool

Sayali Kukarni · Published 2019-03-04 · Updated 2019-03-27 · CVE-2019-1570

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Expedition Migration tool versions 1.1.8 and earlier

Description The issue allows an authenticated attacker to run arbitrary JavaScript or HTML in the LDAP server settings. This is due to a lack of protection for the web page structure. Exploitation of the issue may enable a remote attacker to execute arbitrary JavaScript or HTML code.

Recommendations For versions 1.1.8 and earlier, update to a version that addresses this issue, as no specific workaround is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2019-01284

CVE-2019-1570

Affected Products

Expedition Migration Tool

References · 7

• 🔥 https://tenable.com/security/research/tra-2019-13 · Exploit
• https://bdu.fstec.ru/vul/2019-01284 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-1570 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1570 · Vendor Advisory
• http://securityfocus.com/bid/107564 · Note
• https://securityadvisories.paloaltonetworks.com/Home/Detail/142 · Note
• https://securityfocus.com/bid/107564 · Note