PT-2020-10292 · Intland · Codebeamer Alm

Published 2020-03-27 · Updated 2023-10-18 · CVE-2019-19912

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Intland codeBeamer ALM versions 9.5 and earlier

Description A cross-site scripting (XSS) vulnerability in the Upload Flash File feature allows authenticated remote attackers to inject arbitrary scripts via an active script embedded in an SWF file. This issue affects the Upload Flash File feature, where an active script embedded in an SWF file can be used to inject arbitrary scripts.

Recommendations For versions 9.5 and earlier, consider disabling the Upload Flash File feature until a patch is available to prevent exploitation of the XSS vulnerability. Restrict access to the Upload Flash File feature to minimize the risk of exploitation. Avoid using the Upload Flash File feature with SWF files that contain active scripts until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-19912

Affected Products

Codebeamer Alm

References · 6

• 🔥 http://packetstormsecurity.com/files/156951/codeBeamer-9.5-Cross-Site-Scripting.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-19912 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19912 · Security Note
• https://t.me/defcon_news/42536 · Telegram Post
• https://t.me/cvenotify/2272 · Telegram Post
• https://t.me/cibsecurity/10859 · Telegram Post