PT-2021-9037 · Viki Vera · Viki Vera

Published 2021-01-05 · Updated 2021-01-08 · CVE-2019-20483

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Viki Vera version 4.9.1.26180

Description An issue was discovered where an attacker could set a user's last name to an XSS Payload. This allows the attacker to read another user's cookie and use it to login to the application.

Recommendations For Viki Vera version 4.9.1.26180, consider restricting the ability to set user last names to trusted users or validating input to prevent XSS Payloads until a patch is available. As a temporary workaround, restrict access to sensitive user information to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-20483

Affected Products

Viki Vera

References · 4

• 🔥 https://gosecure.net/blog/2020/12/15/vera-stored-xss-improper-access-control · Exploit
• https://osv.dev/vulnerability/CVE-2019-20483 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20483 · Security Note
• https://t.me/cibsecurity/21647 · Telegram Post