PT-2022-3560 · Aethon · Tug Home Base Server

Published 2022-04-12 · Updated 2022-10-21 · CVE-2022-27494

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:P/I:C/A:P

Name of the Vulnerable Software and Affected Versions Aethon TUG Home Base Server versions prior to version 24

Description The issue is related to the lack of input data sanitization in the "Reports" component of the TUG Home Base Server, which can allow a remote attacker to conduct a cross-site scripting (XSS) attack. Additionally, an unauthenticated attacker can freely access hashed user credentials.

Recommendations For versions prior to 24, update to version 24 or later to resolve the issue. As a temporary workaround, consider restricting access to the "Reports" component until a patch is available. Avoid using the TUG Home Base Server with untrusted input data until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-04344

CVE-2022-27494

Affected Products

Tug Home Base Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-27494 · Security Note
• https://bdu.fstec.ru/vul/2022-04344 · Security Note
• https://osv.dev/vulnerability/CVE-2022-27494 · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsa-22-102-05 · Note
• https://t.me/cibsecurity/51940 · Telegram Post