PT-2020-12649
CVE-2020-11499
·
تاريخ النشر
2020-04-02
·
تاريخ التحديث
2020-04-06
الوصف من
CVSS 3.1
6.1
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Firmware Analysis and Comparison Tool (FACT) version 3
Description
The issue is related to Stored XSS when updating analysis details via a localhost web request. This is caused by the mishandling of the
tags and version fields in the helperFunctions/mongo task conversion.py file.Recommendations
For Firmware Analysis and Comparison Tool (FACT) version 3, consider restricting access to the
helperFunctions/mongo task conversion.py file until a patch is available. As a temporary workaround, avoid using the tags and version fields in the affected API endpoint until the issue is resolved.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾