PT-2020-14603
CVE-2020-15716
·
تاريخ النشر
2020-07-15
·
تاريخ التحديث
2020-07-22
الوصف من
CVSS 3.1
6.1
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
RosarioSIS version 6.7.2
Description
The issue is caused by improper validation of user-supplied input by the Preferences.php script, allowing for XSS attacks. A remote attacker could exploit this using the
tab parameter in a crafted URL, such as "/preferences.php?tab=".Recommendations
For RosarioSIS version 6.7.2, update the Preferences.php script to properly validate user-supplied input to prevent XSS attacks. As a temporary workaround, consider restricting access to the Preferences.php script until a patch is available. Avoid using the
tab parameter in crafted URLs until the issue is resolved.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾