CVE-2017-14973

Name of the Vulnerable Software and Affected Versions IDenticard Two-Reader Controller Configuration Manager version 1.18.8

Description The issue concerns a Stored Cross-Site Scripting (XSS) flaw. It can be exploited via the notes field in the "/~user handler?file=logged in.shtm" endpoint, also known as the edit user page.

Recommendations For IDenticard Two-Reader Controller Configuration Manager version 1.18.8, as a temporary workaround, consider restricting access to the /~user handler?file=logged in.shtm endpoint until a patch is available. Avoid using the notes field in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.