PT-2020-20176
CVE-2020-8496
·
تاريخ النشر
2020-01-30
·
تاريخ التحديث
2020-02-05
الوصف من
CVSS 3.1
6.9
متوسطةالمقاييسAC:L/AV:N/A:N/C:L/I:H/PR:H/S:C/UI:R
Name of the Vulnerable Software and Affected Versions
Kronos Web Time and Attendance (webTA) versions 4.1.x through 4.x before 5.0
Description
The issue concerns a Stored XSS vulnerability. It can be triggered by setting the Application Banner input field of the "/ApplicationBanner" page as an authenticated administrator.
Recommendations
For versions 4.1.x through 4.x before 5.0, update to version 5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/ApplicationBanner" page for authenticated administrators until a patch is available. Avoid using the Application Banner input field in the affected page until the issue is resolved.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾