PT-2022-5013 · Crealogix · Crealogix Ebics

Tobias Ospelt · Published 2022-10-10 · Updated 2022-10-11 · CVE-2022-3442

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Crealogix EBICS version 7.0

Description A vulnerability was found in the /ebics-server/ebics.aspx component of Crealogix EBICS, which can be exploited to conduct a cross-site scripting (XSS) attack. The attack may be launched remotely. The issue arises due to inadequate protection of the web page structure.

Recommendations For Crealogix EBICS version 7.0, upgrade to version 7.1 to address this issue. As a temporary workaround, consider restricting access to the /ebics-server/ebics.aspx endpoint until the upgrade is applied.

Exploit

Fix

Improper Neutralization

Special Elements Injection

XSS

Weakness Enumeration

CWE-707

CWE-74

CWE-79

Related Identifiers

BDU:2022-06226

CVE-2022-3442

Affected Products

Crealogix Ebics

References · 6

• 🔥 https://pentagrid.ch/en/blog/reflected-xss-vulnerability-in-crealogix-ebics-implementation · Exploit
• https://bdu.fstec.ru/vul/2022-06226 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-3442 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3442 · Vendor Advisory
• https://vuldb.com/?id.210374 · Note
• https://t.me/cibsecurity/51065 · Telegram Post