PT-2019-19956 · Espressreport · Espressreport Es

Published 2019-06-24 · Updated 2024-02-14 · CVE-2019-9957

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions EspressReport ES (ERES) version 7.0 update 7

Description The issue allows remote attackers to execute malicious JavaScript and inject arbitrary source code into target pages through a stored XSS attack. This is achieved by creating a new user account with a username set to an XSS payload. The stored payload can be triggered by accessing the "Set Security Levels" or "View User/Group Relationships" page. In cases where the attacker lacks permission to create a new user, another vulnerability like CSRF must be exploited first.

Recommendations For EspressReport ES (ERES) version 7.0 update 7, consider disabling the user account creation feature until a patch is available to prevent the exploitation of this issue. Additionally, restrict access to the "Set Security Levels" and "View User/Group Relationships" pages to minimize the risk of stored XSS payload execution.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-9957

Affected Products

Espressreport Es

References · 3

• 🔥 https://crawl3r.xyz/cve/cve-2019-9957 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-9957 · Security Note
• https://osv.dev/vulnerability/CVE-2019-9957 · Vendor Advisory