Описание
An issue was discovered in SWIFT Alliance Web Platform 7.1.23. A log injection (and an arbitrary log filename) can be achieved via the PATH_INFO to swp/login/EJBRemoteService/, related to com.swift.ejbgwt.j2ee.client.EjBlnvocationException error log information containing null@java:comp/env/ error messages.
Ссылки
- Third Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:swift:alliance_web_platform:7.1.23:*:*:*:*:*:*:*
EPSS
Процентиль: 46%
0.00237
Низкий
7.5 High
CVSS3
5 Medium
CVSS2
Дефекты
CWE-116
Связанные уязвимости
CVSS3: 7.5
github
больше 3 лет назад
An issue was discovered in SWIFT Alliance Web Platform 7.1.23. A log injection (and an arbitrary log filename) can be achieved via the PATH_INFO to swp/login/EJBRemoteService/, related to com.swift.ejbgwt.j2ee.client.EjBlnvocationException error log information containing null@java:comp/env/ error messages.
EPSS
Процентиль: 46%
0.00237
Низкий
7.5 High
CVSS3
5 Medium
CVSS2
Дефекты
CWE-116