CVE-2019-7417

Name of the Vulnerable Software and Affected Versions Ericsson Active Library Explorer (ALEX) version 14.3

Description A security issue exists in the software, where an XSS issue is present in multiple parameters of the "/cgi-bin/alexserv" servlet. The affected parameters include DB, FN, fn, and id.

Recommendations For Ericsson Active Library Explorer (ALEX) version 14.3, consider restricting access to the vulnerable servlet "/cgi-bin/alexserv" to minimize the risk of exploitation. Avoid using the parameters DB, FN, fn, and id in the affected API endpoint until the issue is resolved.