PT-2022-7786 · Unknown · Yuna Scatari Tbdev

Published 2022-12-31 · Updated 2024-05-17 · CVE-2014-125027

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Yuna Scatari TBDev versions up to 2.1.17

Description A vulnerability has been found in Yuna Scatari TBDev, classified as problematic. The issue affects the function get user icons of the file usersearch.php. The manipulation of the argument n/r/r2/em/ip/co/ma/d/d2/ul/ul2/ls/ls2/dl/dl2 leads to cross-site scripting. The attack can be launched remotely.

Recommendations Upgrading to version 2.1.18 is able to address this issue. It is recommended to upgrade the affected component. As a temporary workaround, consider disabling the get user icons function until a patch is available. Restrict access to the usersearch.php file to minimize the risk of exploitation. Avoid using the argument n/r/r2/em/ip/co/ma/d/d2/ul/ul2/ls/ls2/dl/dl2 in the affected component until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-125027

Affected Products

Yuna Scatari Tbdev

References · 7

• https://github.com/yunasc/tbdev/releases/tag/v2.1.18 · Patch
• https://github.com/yunasc/tbdev/commit/0ba3fd4be29dd48fa4455c236a9403b3149a4fd4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2014-125027 · Security Note
• https://t.me/cvenotify/41063 · Telegram Post
• https://vuldb.com/?id.217147 · Note
• https://vuldb.com/?ctiid.217147 · Note
• https://t.me/cibsecurity/55675 · Telegram Post