PT-2020-2062 · Andover · Andover Continuum

Published 2020-03-10 · Updated 2020-03-24 · CVE-2020-7481

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Andover Continuum versions all

Description A Cross-site Scripting vulnerability exists, which could enable a successful Cross-site Scripting attack when using the product's web server. This issue is related to improper neutralization of input during web page generation. The vulnerability may allow a remote attacker to conduct an XSS attack during the use of the web server applications.

Recommendations For all versions, consider disabling the web server functionality until a patch is available to prevent potential Cross-site Scripting attacks. Restrict access to the web server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-01895

CVE-2020-7481

Affected Products

Andover Continuum

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-7481 · Security Note
• https://bdu.fstec.ru/vul/2020-01895 · Security Note
• https://se.com/ww/en/download/document/SEVD-2020-070-04 · Vendor Advisory
• https://t.me/cvenotify/2043 · Telegram Post