PT-2020-10151 · Abacus · Abacus Oauth Login

Ville Koch · Published 2020-03-11 · Updated 2020-03-20 · CVE-2019-19381

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Abacus OAuth Login versions 2019 01 r4 20191021 0000 through prior to R4 (20.11.2019 Hotfix)

Description The issue allows Reflected Cross Site Scripting (XSS) via an error message. This occurs in the "oauth/oauth2/v1/saml/" endpoint.

Recommendations For versions 2019 01 r4 20191021 0000 through prior to R4 (20.11.2019 Hotfix), update to a version after R4 (20.11.2019 Hotfix) to resolve the issue. As a temporary workaround, consider restricting access to the "oauth/oauth2/v1/saml/" endpoint until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-19381

Affected Products

Abacus Oauth Login

References · 5

• 🔥 https://compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2019-024_Abacus_Cross-Site_Scripting_XSS.txt · Exploit
• https://osv.dev/vulnerability/CVE-2019-19381 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19381 · Security Note
• https://compass-security.com/en/research/advisories · Note
• https://t.me/cvenotify/1508 · Telegram Post