PT-2019-17067 · Hcl · Hcl Traveler

Published 2019-10-18 · Updated 2019-10-30 · CVE-2019-4409

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HCL Traveler versions 9.x and earlier

Description The issue concerns a cross-site scripting (XSS) vulnerability. Specifically, on the Problem Report page of the Traveler servlet pages, there is a field for specifying a file attachment to provide additional problem details. If an invalid file name is entered and the error message returned includes the file name without proper escaping, it could expose an XSS vulnerability.

Recommendations For HCL Traveler versions 9.x and earlier, ensure that file names entered for attachments on the Problem Report page are properly escaped in the returned error page to prevent XSS attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-4409

Affected Products

Hcl Traveler

References · 3

• https://hclpnpsupport.hcltech.com/csm?id=kb_article&sysparm_article=KB0073231 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-4409 · Security Note
• https://osv.dev/vulnerability/CVE-2019-4409 · Vendor Advisory