CVE-2019-14298

Name of the Vulnerable Software and Affected Versions Veeam ONE Reporter version 9.5.0.3201

Description The issue allows for cross-site scripting (XSS) attacks via a crafted Description field in the config to addDashboard or editDashboard in CommonDataHandlerReadOnly.ashx. This can potentially lead to the execution of malicious scripts.

Recommendations For Veeam ONE Reporter version 9.5.0.3201, consider restricting access to the CommonDataHandlerReadOnly.ashx endpoint until a patch is available. As a temporary workaround, avoid using the Description field in the config for addDashboard or editDashboard operations to minimize the risk of exploitation.