CVE-2019-17120

Опубликовано: 17 окт. 2019

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/adm_usrs.jsp. The usr parameter is vulnerable: the reflected cross-site scripting occurs immediately after the user is created. The malicious script is stored and will be executed whenever /WiKIDAdmin/adm_usrs.jsp is visited.

Ссылки

http://packetstormsecurity.com/files/154912/WiKID-Systems-2FA-Enterprise-Server-4.2.0-b2032-SQL-Injection-XSS-CSRF.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2019/Oct/35
Exploit
Mailing List
Third Party Advisory
https://www.securitymetrics.com/blog/wikid-2fa-enterprise-server-cross-site-scripting
Exploit
Third Party Advisory
http://packetstormsecurity.com/files/154912/WiKID-Systems-2FA-Enterprise-Server-4.2.0-b2032-SQL-Injection-XSS-CSRF.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2019/Oct/35
Exploit
Mailing List
Third Party Advisory
https://www.securitymetrics.com/blog/wikid-2fa-enterprise-server-cross-site-scripting
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.81:b676:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.85:b780:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.87:b1092:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.87:b1159:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.87:b1169:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.87:b1216:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.87:b824:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.87:b839:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1342:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1352:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1359:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1373:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1403:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1411:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1421:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1428:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1438:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1472:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1542:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1580:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.6.0:b1659:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.6.0:b1672:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0:b1787:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0:b1798:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0:b1803:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0.1:b1817:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0.1:b1821:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0.1:b1905:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0.1:b1906:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0.2:b1917:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0.2:b1921:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.1.0:b1926:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.1.0:b1941:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.1.0:b1949:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.1.0:b1955:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b1978:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b1981:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b1984:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2007:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2014:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2016:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2020:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2023:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2028:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2032:*:*:*:*:*:*

cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2047:*:*:*:*:*:*

EPSS

Процентиль: 90%

0.06017

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-c8f6-jm2m-h3gm