exploitDog

CVE-2015-3443

Опубликовано: 02 июл. 2015

Источник: nvd

CVSS2: 3.5

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in the basic dashboard in Thycotic Secret Server 8.6.x, 8.7.x, and 8.8.x before 8.8.000005 allows remote authenticated users to inject arbitrary web script or HTML via a password entry, which is not properly handled when toggling the password mask.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:thycotic:secret_server:8.6.000000:*:*:*:*:*:*:*

cpe:2.3:a:thycotic:secret_server:8.6.000009:*:*:*:*:*:*:*

cpe:2.3:a:thycotic:secret_server:8.6.000010:*:*:*:*:*:*:*

cpe:2.3:a:thycotic:secret_server:8.7.000000:*:*:*:*:*:*:*

cpe:2.3:a:thycotic:secret_server:8.8.000000:*:*:*:*:*:*:*

cpe:2.3:a:thycotic:secret_server:8.8.000001:*:*:*:*:*:*:*

cpe:2.3:a:thycotic:secret_server:8.8.000004:*:*:*:*:*:*:*

EPSS

Процентиль: 76%

0.00972

Низкий

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-vfrp-379g-5hwr

github

больше 3 лет назад

Cross-site scripting (XSS) vulnerability in the basic dashboard in Thycotic Secret Server 8.6.x, 8.7.x, and 8.8.x before 8.8.000005 allows remote authenticated users to inject arbitrary web script or HTML via a password entry, which is not properly handled when toggling the password mask.

EPSS

Процентиль: 76%

0.00972

Низкий

3.5 Low

CVSS2

Дефекты

CWE-79