PT-2020-20176 · Kronos · Kronos Web Time/Attendance

Elwood Buck + 1 · Published 2020-01-30 · Updated 2020-02-05 · CVE-2020-8496

Positive Technologies (AI Summary)

CVSS v3.1

6.9

Medium

Base vector

AC:L/AV:N/A:N/C:L/I:H/PR:H/S:C/UI:R

Name of the Vulnerable Software and Affected Versions Kronos Web Time and Attendance (webTA) versions 4.1.x through 4.x before 5.0

Description The issue concerns a Stored XSS vulnerability. It can be triggered by setting the Application Banner input field of the "/ApplicationBanner" page as an authenticated administrator.

Recommendations For versions 4.1.x through 4.x before 5.0, update to version 5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/ApplicationBanner" page for authenticated administrators until a patch is available. Avoid using the Application Banner input field in the affected page until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-8496

Affected Products

Kronos Web Time/Attendance

References · 5

• 🔥 http://nolanbkennedy.com/post/stored-xss-2-in-kronos-web-time-and-attendance-webta · Exploit
• https://osv.dev/vulnerability/CVE-2020-8496 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8496 · Security Note
• https://kronos.com/products/kronos-webta · Vendor Advisory
• https://t.me/cvenotify/690 · Telegram Post