PT-2020-15646 · United Planet · Intrexx

Published 2020-10-14 · Updated 2023-07-20 · CVE-2020-24188

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Intrexx versions prior to 9.4.0

Description The issue is related to a cross-site scripting (XSS) vulnerability in the search functionality. This allows remote attackers to inject arbitrary web script or HTML via the request parameter.

Recommendations For versions prior to 9.4.0, update to version 9.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the search functionality until a patch is available. Avoid using the vulnerable search feature in the affected versions until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-24188

Affected Products

Intrexx

References · 4

• https://osv.dev/vulnerability/CVE-2020-24188 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24188 · Security Note
• https://onlinehelp.unitedplanet.com/intrexx/9400/en/index.html?p=helpfiles/help.3.onlineupdate-02.html · Vendor Advisory
• https://t.me/cvenotify/54738 · Telegram Post