PT-2023-18887 · Unknown · Provide Server

CVE-2023-23286

·

Publicado

2023-02-10

·

Atualizado

2023-04-06

CVSS v3.1

6.1

Média

VetorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Provide server version 14.4
Description The issue allows attackers to execute arbitrary code through the server-log via the username field from the login form. This is a Cross Site Scripting (XSS) issue.
Recommendations For Provide server version 14.4, consider disabling the login form or restricting access to the server-log until a fix is available. Avoid using the username field in the login form to minimize the risk of exploitation.

Exploit

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-23286

Produtos afetados

Provide Server