PT-2019-4381 · Huawei · Hedex Lite

Kai Zhao · Published 2019-06-05 · Updated 2019-06-14 · CVE-2019-5286

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HedEx Lite versions earlier than V200R006C00SPC007

Description The issue is related to a reflection XSS vulnerability in HedEx products, where remote attackers can send malicious links to users, tricking them into clicking, which can initiate XSS attacks. The vulnerability is also described as being related to the failure to protect the web page structure, allowing a remote attacker to perform cross-site scripting attacks using a malicious link.

Recommendations For HedEx Lite versions earlier than V200R006C00SPC007, update to version V200R006C00SPC007 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable web pages or links to minimize the risk of exploitation. Avoid using links from untrusted sources in the affected HedEx Lite versions until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-00102

CVE-2019-5286

Affected Products

Hedex Lite

References · 4

• https://huawei.com/en/psirt/security-advisories/huawei-sa-20190605-01-hedex-en · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-5286 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00102 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-5286 · Security Note