PT-2021-9672 · Outsystems · Outsystems

Fábio Gomes · Published 2021-08-31 · Updated 2021-09-08 · CVE-2020-13639

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OutSystems versions prior to 10.0.1005.2 OutSystems versions prior to 11.7.0 LifeTime Management Console OutSystems versions prior to 11.9.0 Platform Server

Description A stored XSS issue was discovered in the ECT Provider, affecting generated applications. It allows an unauthenticated remote attacker to craft and store malicious Feedback content into "/ECT Provider/", such that when the content is viewed by Administrators, attacker-controlled JavaScript will execute in the security context of an administrator's browser.

Recommendations For versions prior to 10.0.1005.2, update to version 10.0.1005.2 or later. For versions prior to 11.7.0 LifeTime Management Console, update to version 11.7.0 LifeTime Management Console or later. For versions prior to 11.9.0 Platform Server, update to version 11.9.0 Platform Server or later. As a temporary workaround, consider restricting access to the "/ECT Provider/" endpoint to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-13639

Affected Products

Outsystems

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-13639 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13639 · Vendor Advisory
• https://t.me/cibsecurity/28055 · Telegram Post
• https://outsystems.com/platform · Note
• https://labs.integrity.pt/advisories/CVE-2020-13639 · Note