PT-2020-10316

CVE-2019-20003

·

Published

2020-01-17

·

Updated

2020-01-27

Description by

CVSS 3.1
6.1
Medium
MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Feldtech easescreen Crystal version 9.0 Web-Services 9.0.1.16265
Description The issue allows for Stored XSS via the Debug-Log and Display-Log components. This could be exploited when an attacker sends a crafted string for FTP authentication, potentially affecting the security of the system.
Recommendations For version 9.0 Web-Services 9.0.1.16265, consider disabling the Debug-Log and Display-Log components as a temporary workaround until a patch is available. Restrict access to FTP authentication to minimize the risk of exploitation.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
CVE-2019-20003
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com