CVE-2019-16385

Name of the Vulnerable Software and Affected Versions Cybele Thinfinity VirtualUI version 2.5.17.2

Description The issue allows HTTP response splitting via the mimetype parameter within a PDF viewer request. This can be exploited by loading an application request to view a PDF containing a malicious payload, resulting in a reflected XSS payload being executed. For example, an attack could be demonstrated using a request like 'example.pdf?mimetype=' substring.

Recommendations For Cybele Thinfinity VirtualUI version 2.5.17.2, consider restricting access to the PDF viewer request or disabling the mimetype parameter to minimize the risk of exploitation until a patch is available. Avoid using the mimetype parameter in the affected API endpoint until the issue is resolved.