Описание
The ISO-8859-1 encoder in Resin Pro before 4.0.40 does not properly perform Unicode transformations, which allows remote attackers to bypass intended text restrictions via crafted characters, as demonstrated by bypassing an XSS protection mechanism.
Ссылки
- Patch
- Third Party AdvisoryUS Government Resource
- Patch
- Third Party AdvisoryUS Government Resource
Уязвимые конфигурации
Конфигурация 1Версия до 4.0.39 (включая)
Одно из
cpe:2.3:a:caucho:resin:*:*:*:*:professional:*:*:*
cpe:2.3:a:caucho:resin:4.0.36:*:*:*:professional:*:*:*
cpe:2.3:a:caucho:resin:4.0.37:*:*:*:professional:*:*:*
cpe:2.3:a:caucho:resin:4.0.38:*:*:*:professional:*:*:*
EPSS
Процентиль: 60%
0.00397
Низкий
5 Medium
CVSS2
Дефекты
CWE-20
Связанные уязвимости
github
больше 3 лет назад
The ISO-8859-1 encoder in Resin Pro before 4.0.40 does not properly perform Unicode transformations, which allows remote attackers to bypass intended text restrictions via crafted characters, as demonstrated by bypassing an XSS protection mechanism.
EPSS
Процентиль: 60%
0.00397
Низкий
5 Medium
CVSS2
Дефекты
CWE-20