CVE-2019-9591

Опубликовано: 06 мар. 2019

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE before 19.49.1500.0 allows remote attackers to inject arbitrary web script or HTML via the brandUrl parameter.

Ссылки

http://packetstormsecurity.com/files/152431/ShoreTel-Connect-ONSITE-Cross-Site-Scripting-Session-Fixation.html
Exploit
Third Party Advisory
VDB Entry
https://github.com/Ramikan/Vulnerabilities/blob/master/Shoretel%20Connect%20Multiple%20Vulnerability
Exploit
Third Party Advisory
https://www.exploit-db.com/exploits/46666/
Exploit
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/152431/ShoreTel-Connect-ONSITE-Cross-Site-Scripting-Session-Fixation.html
Exploit
Third Party Advisory
VDB Entry
https://github.com/Ramikan/Vulnerabilities/blob/master/Shoretel%20Connect%20Multiple%20Vulnerability
Exploit
Third Party Advisory
https://www.exploit-db.com/exploits/46666/
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:mitel:connect_onsite:*:*:*:*:*:*:*:*

Версия до 19.49.1500.0 (исключая)

EPSS

Процентиль: 86%

0.02695

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-qpw8-c5vm-gx2f