PT-2020-7752 · Unknown · Tennisconnect Components

Published 2020-01-28 · Updated 2020-01-30 · CVE-2014-8490

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions TennisConnect COMPONENTS version 9.927

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the pid parameter to "index.cfm".

Recommendations For TennisConnect COMPONENTS version 9.927, avoid using the pid parameter in the "index.cfm" endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-8490

Affected Products

Tennisconnect Components

References · 3

• 🔥 http://seclists.org/fulldisclosure/2014/Dec/83 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-8490 · Security Note
• http://tetraph.com/security/cves/cve-2014-8490-tennisconnect-components-system-xss-cross-site-scripting-security-vulnerability · Note