PT-2022-12451 · Unknown · Ponton X/P Messenger

Stefan Walter · Published 2022-03-13 · Updated 2022-03-20 · CVE-2021-45888

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PONTON X/P Messenger versions prior to 3.11.2

Description The navigation tree in the web application is susceptible to XSS, allowing the injection of JavaScript into its nodes. This issue can be exploited by users with the role of Configuration Administrator or Administrator, who have the capability to create such nodes.

Recommendations For versions prior to 3.11.2, update to version 3.11.2 or later to resolve the issue. As a temporary workaround, consider restricting the creation of new nodes in the navigation tree to minimize the risk of exploitation. Additionally, limiting the privileges of users with the roles Configuration Administrator or Administrator may also help mitigate the risk until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-45888

Affected Products

Ponton X/P Messenger

References · 5

• 🔥 https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-079.txt · Exploit
• https://osv.dev/vulnerability/CVE-2021-45888 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45888 · Security Note
• https://ponton.de/products/xpmessenger · Vendor Advisory
• https://t.me/cibsecurity/38844 · Telegram Post