PT-2019-9068 · Polaris Ft · Polaris Ft Intellect Core Banking

Hai Dang Long + 1 · Published 2019-04-30 · Updated 2019-05-03 · CVE-2018-14875

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Polaris FT Intellect Core Banking version 9.7.1

Description A reflected XSS issue exists in the Core and Portal modules, which can be exploited with an authenticated session. The issue is related to the Customerid, formName, FrameId, or MODE parameters.

Recommendations For Polaris FT Intellect Core Banking version 9.7.1, consider restricting access to the affected parameters Customerid, formName, FrameId, and MODE to minimize the risk of exploitation until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-14875

Affected Products

Polaris Ft Intellect Core Banking

References · 3

• 🔥 https://neetech18.blogspot.com/2019/03/reflected-xss-vulnerability-in-polaris.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-14875 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14875 · Vendor Advisory