PT-2020-15946 · Eramba · Eramba

Joern Schneeweisz · Published 2020-09-03 · Updated 2020-09-10 · CVE-2020-25104

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions eramba versions c2.8.1 through e2.19.2 eramba Enterprise versions prior to e2.19.3

Description The issue allows for cross-site scripting (XSS) attacks via a crafted filename for a file attached to an object. This can be achieved by including a complete XSS payload followed by a file extension, such as .png, in the filename.

Recommendations For eramba versions c2.8.1 through e2.19.2, update to version e2.19.3 or later. For eramba Enterprise versions prior to e2.19.3, update to version e2.19.3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-25104

Affected Products

Eramba

References · 4

• 🔥 https://discussions.eramba.org/t/bug-security-vulnerabilities-not-serious/1650 · Exploit
• https://osv.dev/vulnerability/CVE-2020-25104 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25104 · Security Note
• https://gitlab.com/gitlab-com/gl-security/disclosures/-/blob/master/005_eramba/eramba_persistent_xss.md · Note