PT-2019-18694 · Prima Systems · Flexair

Gjoko Krstic · Published 2019-06-05 · Updated 2022-10-25 · CVE-2019-7671

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Prima Systems FlexAir versions 2.3.38 and prior

Description The issue arises from parameters sent to scripts not being properly sanitized before being returned to the user. This may allow an attacker to execute arbitrary code in a user’s browser session in the context of an affected site.

Recommendations For versions 2.3.38 and prior, update to a version later than 2.3.38 to resolve the issue. At the moment, there is no information about other specific mitigation measures for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-7671

Affected Products

Flexair

References · 8

• 🔥 https://exploit-db.com/exploits/47633 · Exploit
• 🔥 http://packetstormsecurity.com/files/155274/Prima-Access-Control-2.3.35-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-7671 · Security Note
• https://osv.dev/vulnerability/CVE-2019-7671 · Vendor Advisory
• https://applied-risk.com/resources/ar-2019-007 · Note
• https://applied-risk.com/labs/advisories · Note
• https://applied-risk.com/index.php/download_file/view/199/165 · Note
• https://us-cert.gov/ics/advisories/icsa-19-211-02 · Note