PT-2020-10352 · Treasuryxpress · Treasuryxpress

Published 2020-08-20 · Updated 2020-08-24 · CVE-2019-20151

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TreasuryXpress version 19191105

Description A security issue was discovered due to the lack of filtering and sanitization of user input, allowing malicious JavaScript to be executed by the application's administrator(s). A malicious payload can be injected within the Multi Approval security component via the Note field, resulting in the payload being executed by the application's administrator(s).

Recommendations For TreasuryXpress version 19191105, as a temporary workaround, consider disabling the Note field in the Multi Approval security component to prevent malicious payload injection until a fix is available. Restrict access to the Multi Approval security component to minimize the risk of exploitation. Avoid using the Note field in the affected component until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-20151

Affected Products

Treasuryxpress

References · 3

• 🔥 https://sion-evans.com/blog/CVE-2019-20151.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-20151 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20151 · Security Note