CVE-2014-8557

Name of the Vulnerable Software and Affected Versions JExperts Channel Platform version 5.0.33 CCB

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the usuario.nome variable in an 'editarUsuario' action to 'usuario.do' or the titulo.form variable in a 'novoChamado' action to 'ticket.do'.

Recommendations For JExperts Channel Platform version 5.0.33 CCB, as a temporary workaround, consider restricting access to the 'usuario.do' and 'ticket.do' endpoints until a patch is available. Avoid using the usuario.nome and titulo.form variables in the affected actions until the issue is resolved.