PT-2023-11823 · Unknown · Geni Portal

Published 2023-01-18 · Updated 2024-05-17 · CVE-2020-36654

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GENI Portal (affected versions not specified)

Description A problematic vulnerability has been found in GENI Portal, affecting the function no invocation id error of the file portal/www/portal/sliceresource.php. The manipulation of the arguments invocation id and invocation user leads to cross-site scripting. It is possible to initiate the attack remotely.

Recommendations To fix this issue, it is recommended to apply a patch named 39a96fb4b822bd3497442a96135de498d4a81337. As a temporary workaround, consider disabling the no invocation id error function until a patch is available. Restrict access to the sliceresource.php file to minimize the risk of exploitation. Avoid using the arguments invocation id and invocation user in the affected function until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-36654

Affected Products

Geni Portal

References · 9

• https://github.com/GENI-NSF/geni-portal/pull/1824 · Patch
• https://github.com/GENI-NSF/geni-portal/commit/39a96fb4b822bd3497442a96135de498d4a81337 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-36654 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36654 · Vendor Advisory
• https://t.me/cvenotify/42262 · Telegram Post
• https://vuldb.com/?id.218475 · Note
• https://t.me/cvenotify/60516 · Telegram Post
• https://vuldb.com/?ctiid.218475 · Note
• https://t.me/cibsecurity/56662 · Telegram Post