PT-2019-9624 · Semcosoft · Semcosoft

Pascal Keul + 1 · Published 2019-02-23 · Updated 2019-02-25 · CVE-2018-18692

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Semcosoft version 5.3

Description A reflected Cross-Site scripting issue allows remote attackers to inject arbitrary web scripts or HTML via the username parameter to the "Login Form" API endpoint.

Recommendations For Semcosoft version 5.3, consider validating and sanitizing user input for the username parameter in the Login Form to prevent arbitrary script injection. As a temporary workaround, restrict access to the Login Form until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-18692

Affected Products

Semcosoft

References · 3

• 🔥 https://atomic111.github.io/article/semcosoft-cross-site-scripting · Exploit
• https://osv.dev/vulnerability/CVE-2018-18692 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-18692 · Security Note