PT-2021-11451 · Mydbr · Mydbr

Published 2021-03-15 · Updated 2021-03-24 · CVE-2020-28149

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: myDBR version 5.8.3/4262

Description: The issue allows for Cross Site Scripting (XSS) with the impact of executing arbitrary code remotely. The component affected is the CSRF Token, and the attack vector involves CSRF token injection to achieve XSS.

Recommendations: For myDBR version 5.8.3/4262, consider disabling the CSRF Token component temporarily until a patch is available to prevent CSRF token injection and potential XSS attacks.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-28149

Affected Products

Mydbr

References · 4

• 🔥 https://c41nc.co.uk/cve-2020-28149 · Exploit
• https://osv.dev/vulnerability/CVE-2020-28149 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28149 · Security Note
• https://t.me/cvenotify/11846 · Telegram Post