PT-2019-9624

CVE-2018-18692

Published

2019-02-23

Updated

2019-02-25

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Semcosoft version 5.3

Description A reflected Cross-Site scripting issue allows remote attackers to inject arbitrary web scripts or HTML via the username parameter to the "Login Form" API endpoint.

Recommendations For Semcosoft version 5.3, consider validating and sanitizing user input for the username parameter in the Login Form to prevent arbitrary script injection. As a temporary workaround, restrict access to the Login Form until a patch is available.

Exploitability

Exploit

Fix

Impacts

Researchers

Pascal Keul

Patrick Muench

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers