Stefano Scipioni

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: Italtel S.p.A. i-MCS NFV الإصدار 12.1.0-20211215 الوصف: تتمثل المشكلة في ثغرة أمنية من نوع البرمجة النصية عبر المواقع (XSS) تتيح للمهاجمين البعيدين غير المصادق عليهم إدخال نصوص برمجية ويب تعسفية أو HTML في معلمات HTTP/POST. ويمكن للمهاجمين استغلال هذه الثغرة لتنفيذ نصوص برمجية ضارة في متصفح الضحية. التوصيات: بالنسبة لـ Italtel S.p.A. i-MCS NFV الإصدار 12.1.0-20211215، يُنصح بتقييد الوصول إلى معلمات HTTP/POST لتقليل مخاطر الاستغلال إلى أدنى حد حتى يتوفر تصحيح. كحل بديل مؤقت، تجنب استخدام المعلمات المعرضة للخطر في نقاط نهاية واجهة برمجة التطبيقات (API) المتأثرة حتى يتم حل المشكلة. لا توجد حاليًا أي معلومات حول إصدار أحدث يحتوي على تصحيح لهذه الثغرة الأمنية.

An issue was discovered in the software, related to Incorrect Access Control.

An issue was discovered that allows stored Cross-site scripting (XSS) to occur via POST requests. This means an attacker can inject malicious scripts into the system, which can then be executed by other users, potentially leading to unauthorized actions or data theft.

An issue allows remote unauthenticated attackers to upload files at an arbitrary path.

An issue in SELESTA Visual Access Manager allows attackers to modify the `computer` POST parameter related to the ID of a specific reception by POST HTTP request interception. This can lead to unauthorized access to the application and control of many other receptions beyond the assigned one. The issue can be exploited via local network only.

An issue exists in the Network Element Manager, specifically a Reflected XSS. This issue can be exploited via several API endpoints, including "/oms1350/pages/otn/cpbLogDisplay" via the `filename` parameter, under "/oms1350/pages/otn/connection/E2ERoutingDisplayWithOverLay" via the `id` parameter, and under "/oms1350/pages/otn/mainOtn" via all parameters.

A SQL Injection issue occurs in the /cgi-bin/R19.9/easy1350.pl endpoint of the VM Manager WebUI, specifically via the `id` or `host` HTTP GET parameters. This issue requires an authenticated attacker for exploitation.

An OS Command Injection issue occurs in the `/cgi-bin/R19.9/log.pl` endpoint of the VM Manager WebUI via the `cmd` HTTP GET parameter. This allows authenticated users to execute commands with root privileges on the operating system.

An Unprotected Storage of Credentials issue occurs in the Network Element Manager under `/root/RestUploadManager.xml.DRC` and `/DEPOT/KECustom 199/OTNE DRC/RestUploadManager.xml`. A remote user, authenticated to the operating system with access privileges to the directory `/root` or `/DEPOT`, can read cleartext credentials to access the web portal NFM-T and control all the PPS Network elements.

An issue affects the setup panel under setup/manageheader.php, allowing authenticated remote attackers with administrator credentials to read a cleartext database password due to improper password storage. This issue does not specify the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

The issue allows an unauthenticated user to upload files to an arbitrary path due to Absolute Path Traversal under NMSCI-WebGui/SaveFileUploader. An attacker can modify the `uploadDir` parameter in a POST request to an arbitrary directory. Since the application does not verify the upload directory, this can lead to unauthorized access to the server.

The issue concerns incorrect Access Control. Specifically, it affects the "NMSCI-WebGui/advancedsettings.jsp" and "NMSCI-WebGui/SaveFileUploader" endpoints. This allows an attacker to view unauthorized pages and modify system configuration by bypassing controls without verifying user identity.

The issue allows for Multiple Reflected/Stored XSS, enabling an attacker to inject arbitrary JavaScript. This can be achieved via the "j security check" endpoint under NMSCIWebGui, using the `j username` parameter, or via the "actloglineview.jsp" endpoint under NMSCIWebGui, using the `name` or `actLine` parameters. The injected payload would be triggered every time an authenticated user browses the page containing it.

An issue exists in the software, allowing a remote authenticated attacker to read files on the filesystem arbitrarily due to an Absolute Path Traversal vulnerability. This vulnerability can be exploited via a specific endpoint using the `logfile` parameter.

A reflected XSS issue was discovered, affecting various "/cgi-bin/R14.2*" API endpoints.

An issue exists in the software, where multiple Relative Path Traversal issues are present in different specific endpoints via the `file` parameter. This allows a remote authenticated attacker to read files on the filesystem arbitrarily.

A reflected XSS issue was discovered, affecting various "/oms1350/*" endpoints.

An Open Redirect issue occurs on the login page via the `next` HTTP GET parameter.

The web application stores critical information, such as cleartext user credentials, in world-readable files in the filesystem. This issue occurs under the /usr/Systems/OTNE 1 14 Master/maintenance/trace/web/.otn.default.log endpoint.

The issue allows authenticated users to execute commands on the operating system due to multiple OS Command Injection vulnerabilities. These vulnerabilities occur in the `/cgi-bin/R14.2/log.pl` endpoint via the `cmd` HTTP GET parameter and in the `/cgi-bin/R14.2/checkping.pl` endpoint via the `addr` HTTP GET parameter.