CVE-2017-9085

Name of the Vulnerable Software and Affected Versions Kodak InSite versions 6.5 through 8.0

Description The issue allows remote attackers to inject arbitrary web script. This can be achieved via the paramFile parameter to "/Site/Troubleshooting/DiagnosticReport.asp" or "/Site/Troubleshooting/SpeedTest.asp" API endpoints.

Recommendations For Kodak InSite versions 6.5 through 8.0, consider disabling access to the "/Site/Troubleshooting/DiagnosticReport.asp" and "/Site/Troubleshooting/SpeedTest.asp" API endpoints until a patch is available. Restrict the use of the paramFile parameter in these endpoints to minimize the risk of exploitation.