PT-2017-18693
CVE-2017-9085
·
تاريخ النشر
2017-11-14
·
تاريخ التحديث
2017-11-30
الوصف من
CVSS 3.1
6.1
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Kodak InSite versions 6.5 through 8.0
Description
The issue allows remote attackers to inject arbitrary web script. This can be achieved via the
paramFile parameter to "/Site/Troubleshooting/DiagnosticReport.asp" or "/Site/Troubleshooting/SpeedTest.asp" API endpoints.Recommendations
For Kodak InSite versions 6.5 through 8.0, consider disabling access to the "/Site/Troubleshooting/DiagnosticReport.asp" and "/Site/Troubleshooting/SpeedTest.asp" API endpoints until a patch is available. Restrict the use of the
paramFile parameter in these endpoints to minimize the risk of exploitation. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾