PT-2020-13961 · Secudos · Secudos Qiata Fta

Patrick Hener · Published 2020-10-02 · Updated 2020-10-08 · CVE-2020-14294

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Secudos Qiata FTA version 1.70.19

Description An issue was discovered that allows persistent XSS, which is executed when reading transfer comments or the global notice board, due to a flaw in the comment feature.

Recommendations For Secudos Qiata FTA version 1.70.19, consider disabling the comment feature as a temporary workaround until a patch is available. Restrict access to the global notice board to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-14294

Affected Products

Secudos Qiata Fta

References · 7

• 🔥 https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-024.txt · Exploit
• 🔥 https://github.com/patrickhener/CVE-2020-14294 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2020/Sep/50 · Exploit
• https://qiata.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14294 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14294 · Security Note
• https://syss.de/pentest-blog/syss-2020-024-und-syss-2020-025-zwei-schwachstellen-in-file-transfer-loesung-von-qiata · Note