PT-2022-18156 · Barco · Barco Control Room Management Suite

Published 2022-06-01 · Updated 2022-06-09 · CVE-2022-26978

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Barco Control Room Management Suite web application version prior to 3.14

Description The issue concerns the exposure of a URL "/checklogin.jsp" endpoint, where the os username parameter is not correctly sanitized. This leads to reflected XSS, allowing potential attackers to inject malicious scripts.

Recommendations For versions prior to 3.14, consider disabling access to the "/checklogin.jsp" endpoint until a patch is available. As a temporary workaround, restrict the use of the os username parameter in the affected endpoint to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-26978

Affected Products

Barco Control Room Management Suite

References · 4

• https://barco.com/en/support/knowledge-base/KB12686 · Vendor Advisory
• https://barco.com/en/support/transform-n-management-server · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26978 · Security Note
• https://osv.dev/vulnerability/CVE-2022-26978 · Vendor Advisory