PT-2021-19410 · Sis · Sis-Rewe Go

Florian Lienhart + 1 · Published 2021-05-11 · Updated 2021-05-19 · CVE-2021-31537

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SIS SIS-REWE Go versions prior to 7.7 SP17

Description The issue allows for XSS attacks. It affects the 'rewe/prod/web/index.php' endpoint, with vulnerable parameters being config, version, win, db, pwd, and user. Additionally, the '/rewe/prod/web/rewe go check.php' endpoint is affected, with version and all other parameters being vulnerable.

Recommendations For versions prior to 7.7 SP17, update to version 7.7 SP17 or later to resolve the issue. As a temporary workaround, consider restricting access to the 'rewe/prod/web/index.php' and '/rewe/prod/web/rewe go check.php' endpoints until the update is applied. Avoid using the vulnerable parameters config, version, win, db, pwd, and user in the 'rewe/prod/web/index.php' endpoint and the version parameter in the '/rewe/prod/web/rewe go check.php' endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-31537

Affected Products

Sis-Rewe Go

References · 5

• 🔥 http://seclists.org/fulldisclosure/2021/May/20 · Exploit
• 🔥 https://sec-consult.com/vulnerability-lab/advisory/reflected-xss-sis-infromatik-rewe-go-cve-2021-31537 · Exploit
• https://osv.dev/vulnerability/CVE-2021-31537 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31537 · Security Note
• https://sisinformatik.com/rewe-go · Vendor Advisory