PT-2023-22436 · Exelysis · Exelysis Unified Communication Solution

Published 2023-04-26 · Updated 2023-05-08 · CVE-2023-29836

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Exelysis Unified Communication Solutions (EUCS) version 1.0

Description A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via the Username parameter of the "eucsAdmin login form" API endpoint.

Recommendations For Exelysis Unified Communication Solutions (EUCS) version 1.0, consider disabling the Username parameter in the eucsAdmin login form until a patch is available. Restrict access to the eucsAdmin login form to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-29836

Affected Products

Exelysis Unified Communication Solution

References · 5

• 🔥 https://github.com/IthacaLabs/Exelysis · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-29836 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29836 · Vendor Advisory
• https://t.me/cibsecurity/62937 · Telegram Post
• https://github.com/IthacaLabs/Exelysis/blob/main/EUCS%20Admin%20Login%20XSS.txt · Note