PT-2022-10220 · Easyvista · Easyvista Service Manager

Armysick · Published 2022-10-20 · Updated 2022-10-22 · CVE-2021-33231

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions EasyVista Service Manager version 2018.1.181.1

Description The issue is related to a Cross Site Scripting (XSS) vulnerability in the New equipment page. This vulnerability allows remote attackers to run arbitrary code via the notes field.

Recommendations For EasyVista Service Manager version 2018.1.181.1, consider restricting access to the New equipment page or disabling the notes field until a fix is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-33231

Affected Products

Easyvista Service Manager

References · 5

• 🔥 https://armysick.github.io/cve-2021-33231 · Exploit
• http://easyvista.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33231 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33231 · Vendor Advisory
• https://t.me/cibsecurity/51863 · Telegram Post