Stefano Scipioni

Name of the Vulnerable Software and Affected Versions: Italtel S.p.A. i-MCS NFV version 12.1.0-20211215 Description: The issue is a cross-site scripting (XSS) vulnerability that allows unauthenticated remote attackers to inject arbitrary web script or HTML into HTTP/POST parameters. This can be exploited by attackers to execute malicious scripts on the victim's browser. Recommendations: For Italtel S.p.A. i-MCS NFV version 12.1.0-20211215, consider restricting access to HTTP/POST parameters to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using vulnerable parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

An issue was discovered in the software, related to Incorrect Access Control.

An issue was discovered that allows stored Cross-site scripting (XSS) to occur via POST requests. This means an attacker can inject malicious scripts into the system, which can then be executed by other users, potentially leading to unauthorized actions or data theft.

An issue allows remote unauthenticated attackers to upload files at an arbitrary path.

An issue in SELESTA Visual Access Manager allows attackers to modify the `computer` POST parameter related to the ID of a specific reception by POST HTTP request interception. This can lead to unauthorized access to the application and control of many other receptions beyond the assigned one. The issue can be exploited via local network only.

An issue exists in the Network Element Manager, specifically a Reflected XSS. This issue can be exploited via several API endpoints, including "/oms1350/pages/otn/cpbLogDisplay" via the `filename` parameter, under "/oms1350/pages/otn/connection/E2ERoutingDisplayWithOverLay" via the `id` parameter, and under "/oms1350/pages/otn/mainOtn" via all parameters.

A SQL Injection issue occurs in the /cgi-bin/R19.9/easy1350.pl endpoint of the VM Manager WebUI, specifically via the `id` or `host` HTTP GET parameters. This issue requires an authenticated attacker for exploitation.

An OS Command Injection issue occurs in the `/cgi-bin/R19.9/log.pl` endpoint of the VM Manager WebUI via the `cmd` HTTP GET parameter. This allows authenticated users to execute commands with root privileges on the operating system.

An Unprotected Storage of Credentials issue occurs in the Network Element Manager under `/root/RestUploadManager.xml.DRC` and `/DEPOT/KECustom 199/OTNE DRC/RestUploadManager.xml`. A remote user, authenticated to the operating system with access privileges to the directory `/root` or `/DEPOT`, can read cleartext credentials to access the web portal NFM-T and control all the PPS Network elements.

An issue affects the setup panel under setup/manageheader.php, allowing authenticated remote attackers with administrator credentials to read a cleartext database password due to improper password storage. This issue does not specify the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

The issue allows an unauthenticated user to upload files to an arbitrary path due to Absolute Path Traversal under NMSCI-WebGui/SaveFileUploader. An attacker can modify the `uploadDir` parameter in a POST request to an arbitrary directory. Since the application does not verify the upload directory, this can lead to unauthorized access to the server.

The issue concerns incorrect Access Control. Specifically, it affects the "NMSCI-WebGui/advancedsettings.jsp" and "NMSCI-WebGui/SaveFileUploader" endpoints. This allows an attacker to view unauthorized pages and modify system configuration by bypassing controls without verifying user identity.

The issue allows for Multiple Reflected/Stored XSS, enabling an attacker to inject arbitrary JavaScript. This can be achieved via the "j security check" endpoint under NMSCIWebGui, using the `j username` parameter, or via the "actloglineview.jsp" endpoint under NMSCIWebGui, using the `name` or `actLine` parameters. The injected payload would be triggered every time an authenticated user browses the page containing it.

An issue exists in the software, allowing a remote authenticated attacker to read files on the filesystem arbitrarily due to an Absolute Path Traversal vulnerability. This vulnerability can be exploited via a specific endpoint using the `logfile` parameter.

A reflected XSS issue was discovered, affecting various "/cgi-bin/R14.2*" API endpoints.

An issue exists in the software, where multiple Relative Path Traversal issues are present in different specific endpoints via the `file` parameter. This allows a remote authenticated attacker to read files on the filesystem arbitrarily.

A reflected XSS issue was discovered, affecting various "/oms1350/*" endpoints.

An Open Redirect issue occurs on the login page via the `next` HTTP GET parameter.

The web application stores critical information, such as cleartext user credentials, in world-readable files in the filesystem. This issue occurs under the /usr/Systems/OTNE 1 14 Master/maintenance/trace/web/.otn.default.log endpoint.

The issue allows authenticated users to execute commands on the operating system due to multiple OS Command Injection vulnerabilities. These vulnerabilities occur in the `/cgi-bin/R14.2/log.pl` endpoint via the `cmd` HTTP GET parameter and in the `/cgi-bin/R14.2/checkping.pl` endpoint via the `addr` HTTP GET parameter.