PT-2022-10753 · Softvibe · Softvibe Saraban For Infoma

Published 2022-01-18 · Updated 2024-02-14 · CVE-2021-38695

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SoftVibe SARABAN for INFOMA version 1.1

Description The issue allows users to store scripts in certain fields, such as subject and description, of the document form, enabling stored cross-site scripting (XSS).

Recommendations For SoftVibe SARABAN for INFOMA version 1.1, consider disabling the ability to input scripts in the subject and description fields of the document form until a patch is available. Restrict access to these fields to minimize the risk of exploitation. Avoid using these fields in the affected document form until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-38695

Affected Products

Softvibe Saraban For Infoma

References · 8

• 🔥 https://orangeo.tech/post/2021/12/24/First-CVEs.html · Exploit
• 🔥 https://sawatdee.github.io/post/2021/12/24/First-CVEs.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-38695 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38695 · Security Note
• http://infoma.net/index.php/saraban · Note
• https://t.me/cvenotify/25593 · Telegram Post
• https://t.me/cibsecurity/35697 · Telegram Post
• https://play.google.com/store/apps/details?id=th.co.softvibe.saraban&hl=en&gl=US · Note