PT-2019-5804 · D Link · D-Link Central Wifi Manager Cwm
Published
2019-07-06
·
Updated
2019-07-09
·
CVE-2019-13374
CVSS v2.0
6.4
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
D-Link Central WiFi Manager CWM(100) versions prior to v1.03R0100 BETA6
Description
A cross-site scripting (XSS) issue in the PayAction.class.php resource view allows remote attackers to inject arbitrary web script or HTML via the
passcode parameter in the "index.php/Pay/passcodeAuth" endpoint. This vulnerability is related to the lack of protection measures for the web page structure, which can be exploited by a remote attacker to inject malicious scripts or HTML code.Recommendations
For D-Link Central WiFi Manager CWM(100) versions prior to v1.03R0100 BETA6, update to version v1.03R0100 BETA6 or later to resolve the issue.
As a temporary workaround, consider restricting access to the "index.php/Pay/passcodeAuth" endpoint to minimize the risk of exploitation. Avoid using the
passcode parameter in this endpoint until the issue is resolved.Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
D-Link Central Wifi Manager Cwm