Bugtraq mailing list archives
Emerson Network Power Cross Site Scripting(XSS) Vulnerability
From: Kubilay Onur Gungor <kubilay () cyberstruggle org>
Date: Sat, 18 May 2019 14:20:40 +0300
I. VULNERABILITY ------------------------- httpGetSet/httpGet.htm on Emerson Network Power Liebert Challenger 5.1E0.5 devices allows XSS via the statusstr parameter. II. CVE REFERENCE ------------------------- CVE-2019-12167 III. VENDOR ------------------------- Emerson Network Power IV. TIMELINE ------------------------- 13/05/2019 Vulnerability discovered V. CREDIT ------------------------- Kubilay Onur Gungor from Cyber Struggle VI. DESCRIPTION ------------------------- Cross Site Scripting (XSS) allows clients to inject scripts into a request and have the server return the script to the client in the response. This occurs because the application is taking untrusted data and reusing it without performing any validation or sanitisation. A remote user can conduct cross-site scripting attacks. Affected Component: Path(inurl): /httpGetSet/httpGet.htm? Parameter: statusstr VII. SOLUTION ------------------------- Update to lastest version.
Current thread:
- Emerson Network Power Cross Site Scripting(XSS) Vulnerability Kubilay Onur Gungor (May 19)