PT-2023-15227 · Generex · Generex Cs141

Published 2023-09-28 · Updated 2023-10-02 · CVE-2022-47187

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Generex CS141 versions prior to 2.06

Description The issue is related to a file upload XSS vulnerability. The web application allows file uploading, which makes it possible to upload a file with HTML content. When HTML files are allowed, an XSS payload can be injected into the uploaded file.

Recommendations For versions prior to 2.06, update to version 2.06 or later to resolve the issue. As a temporary workaround, consider restricting file uploads to prevent exploitation until a patch is applied. Avoid allowing HTML files to be uploaded to minimize the risk of XSS payload injection.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-47187

Affected Products

Generex Cs141

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-47187 · Security Note
• https://osv.dev/vulnerability/CVE-2022-47187 · Vendor Advisory
• https://twitter.com/DMFezzaReedCISA/status/1707432126772138379 · Twitter Post
• https://t.me/cibsecurity/71195 · Telegram Post
• https://generex.de/support/changelogs/cs141/2-12 · Note
• https://twitter.com/CVEnew/status/1707389417898254627 · Twitter Post
• https://incibe-cert.es/en/early-warning/ics-advisories/update-03032023-multiple-vulnerabilities-generex-ups-cs141 · Note