PT-2022-12313 · Unknown · Coins Construction Cloud

Philipp Rieth · Published 2022-04-14 · Updated 2022-04-21 · CVE-2021-45228

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions COINS Construction Cloud version 11.12

Description An issue was discovered due to insufficient neutralization of user input in the description of a task, allowing malicious JavaScript code to be stored and later executed when reflected back to the user.

Recommendations For COINS Construction Cloud version 11.12, consider disabling the task description feature until a patch is available to prevent the storage and execution of malicious JavaScript code. Restrict access to task descriptions to minimize the risk of exploitation. Avoid using the task description field in COINS Construction Cloud until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-45228

Affected Products

Coins Construction Cloud

References · 6

• 🔥 https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-031.txt · Exploit
• https://appsource.microsoft.com/en-us/product/web-apps/constructionindustrysolutionslimited-5057232.coinsconstructioncloud?tab=overview · Patch
• https://osv.dev/vulnerability/CVE-2021-45228 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45228 · Security Note
• https://t.me/cibsecurity/40779 · Telegram Post
• https://t.me/cvenotify/29269 · Telegram Post