PT-2020-9556 · Adrem · Adrem Netcrunch

Published 2020-12-16 · Updated 2020-12-17 · CVE-2019-14478

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: AdRem NetCrunch version 10.6.0.4587

Description: The issue is related to a stored Cross-Site Scripting (XSS) vulnerability in the NetCrunch web client. The user's input data is not properly encoded when being echoed back to the user, allowing an attacker to execute JavaScript code in the context of the user's browser if the victim opens or searches for a node whose Display Name contains an XSS payload.

Recommendations: For AdRem NetCrunch version 10.6.0.4587, consider restricting the use of the NetCrunch web client until a patch is available, and ensure that user input data is properly encoded to prevent XSS attacks. As a temporary workaround, avoid using the Display Name field for nodes that may contain potentially malicious input.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-14478

Affected Products

Adrem Netcrunch

References · 5

• 🔥 https://compass-security.com/fileadmin/Research/Advisories/2020-12_CSNC-2019-013_AdRem_NetCrunch_Cross-Site_Scripting_XSS.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-14478 · Security Note
• https://adremsoft.com/support · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-14478 · Vendor Advisory
• https://t.me/cibsecurity/20946 · Telegram Post