PT-2014-8617
CVE-2014-8557
·
تاريخ النشر
2014-11-13
·
تاريخ التحديث
2017-09-08
الوصف من
CVSS 2.0
4.3
متوسطةالمقاييسAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions
JExperts Channel Platform version 5.0.33 CCB
Description
The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the
usuario.nome variable in an 'editarUsuario' action to 'usuario.do' or the titulo.form variable in a 'novoChamado' action to 'ticket.do'.Recommendations
For JExperts Channel Platform version 5.0.33 CCB, as a temporary workaround, consider restricting access to the 'usuario.do' and 'ticket.do' endpoints until a patch is available. Avoid using the
usuario.nome and titulo.form variables in the affected actions until the issue is resolved. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾