PT-2019-9624

CVE-2018-18692

Publicado

2019-02-23

Atualizado

2019-02-25

Descrição por

CVSS 3.1

6.1

Média

MétricasAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Semcosoft version 5.3

Description A reflected Cross-Site scripting issue allows remote attackers to inject arbitrary web scripts or HTML via the username parameter to the "Login Form" API endpoint.

Recommendations For Semcosoft version 5.3, consider validating and sanitizing user input for the username parameter in the Login Form to prevent arbitrary script injection. As a temporary workaround, restrict access to the Login Form until a patch is available.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Pascal Keul

Patrick Muench

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Identificadores relacionados