PT-2023-13469 · Tcman Gim · Tcman Gim

Jorge Alberto Palma Reyes + 1 · Published 2023-10-04 · Updated 2023-10-06 · CVE-2022-36277

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions TCMAN GIM version 8.0.1

Description The issue concerns the sReferencia, sDescripcion, txtCodigo, and txtDescripcion parameters in the "frmGestionStock.aspx" and "frmEditServicio.aspx" files, which could allow an attacker to perform persistent XSS attacks.

Recommendations For TCMAN GIM version 8.0.1, consider restricting or sanitizing the input for the sReferencia, sDescripcion, txtCodigo, and txtDescripcion parameters in the affected files to prevent XSS attacks. As a temporary workaround, restrict access to the frmGestionStock.aspx and frmEditServicio.aspx files until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-36277

Affected Products

Tcman Gim

References · 4

• https://osv.dev/vulnerability/CVE-2022-36277 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36277 · Security Note
• https://t.me/cibsecurity/71606 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcman-gim · Note