PT-2022-3559 · Aethon · Aethon Tug Home Base Server

Published 2022-04-12 · Updated 2022-10-21 · CVE-2022-1059

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:P/I:C/A:P

Name of the Vulnerable Software and Affected Versions Aethon TUG Home Base Server versions prior to version 24

Description The issue is related to the lack of input data sanitization in the "Загрузки" component of the TUG Home Base Server, which can lead to a remote attacker conducting a cross-site scripting (XSS) attack. An unauthenticated attacker can freely access hashed user credentials.

Recommendations For versions prior to version 24, update to version 24 or later to resolve the issue. As a temporary workaround, consider restricting access to the "Загрузки" component to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-04343

CVE-2022-1059

Affected Products

Aethon Tug Home Base Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-1059 · Security Note
• https://bdu.fstec.ru/vul/2022-04343 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1059 · Vendor Advisory
• https://t.me/cibsecurity/51943 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-102-05 · Note