CVE-2019-10846

Name of the Vulnerable Software and Affected Versions Computrols CBAS version 18.0.0

Description The issue allows for Unauthenticated Reflected Cross-Site Scripting in the login page and password reset page. This is achieved via the username GET parameter in the API endpoint, specifically in the login and password reset pages.

Recommendations For Computrols CBAS version 18.0.0, consider disabling the login and password reset functionality until a patch is available to prevent exploitation via the username parameter. Restrict access to these pages to minimize the risk of reflected Cross-Site Scripting attacks.