PT-2020-20173 · Kronos · Kronos Web Time/Attendance

Elwood Buck + 1 · Published 2020-01-30 · Updated 2020-02-05 · CVE-2020-8493

Positive Technologies (AI Summary)

CVSS v3.1

6.9

Medium

Base vector

AC:L/AV:N/A:N/C:L/I:H/PR:H/S:C/UI:R

Name of the Vulnerable Software and Affected Versions Kronos Web Time and Attendance (webTA) versions 3.8.x through 3.x before 4.0

Description A stored XSS issue affects the software via multiple input fields, including Login Message, Banner Message, and Password Instructions, of the com.threeis.webta.H261configMenu servlet. This can be exploited by an authenticated administrator.

Recommendations For versions 3.8.x through 3.x before 4.0, update to version 4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the com.threeis.webta.H261configMenu servlet for authenticated administrators until a patch is available. Avoid using the vulnerable input fields (Login Message, Banner Message, and Password Instructions) in the affected servlet until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-8493

Affected Products

Kronos Web Time/Attendance

References · 7

• 🔥 http://packetstormsecurity.com/files/156215/Kronos-WebTA-4.0-Privilege-Escalation-Cross-Site-Scripting.html · Exploit
• 🔥 http://nolanbkennedy.com/post/stored-xss-in-kronos-web-time-and-attendance-webta · Exploit
• 🔥 https://exploit-db.com/exploits/48001 · Exploit
• https://osv.dev/vulnerability/CVE-2020-8493 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8493 · Security Note
• https://kronos.com/products/kronos-webta · Vendor Advisory
• https://t.me/cvenotify/687 · Telegram Post