PT-2021-21661 · Nch · Nch Ivm Attendant

Published 2021-07-25 · Updated 2021-08-04 · CVE-2021-37448

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NCH IVM Attendant versions 5.12 and earlier

Description Cross Site Scripting (XSS) exists in the software via the Mailbox name (stored). This issue allows for the execution of malicious scripts.

Recommendations For versions 5.12 and earlier, update to a version later than 5.12 to resolve the issue. As a temporary workaround, consider restricting access to the Mailbox name field to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-37448

Affected Products

Nch Ivm Attendant

References · 6

• 🔥 https://github.com/0xfml/poc/blob/main/NCH/IVM_5.12_XSS.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-37448 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37448 · Vendor Advisory
• https://nch.com.au/ivm/index.html · Note
• https://t.me/cvenotify/18096 · Telegram Post
• https://t.me/cibsecurity/26462 · Telegram Post