Описание
In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.
Ссылки
- Permissions Required
- PatchThird Party Advisory
- Release NotesThird Party Advisory
- ExploitThird Party Advisory
- https://user-images.githubusercontent.com/9525971/142965091-e118b012-a7fc-4c2f-ad0c-80aeed6f7ec9.pngThird Party Advisory
- Permissions Required
- PatchThird Party Advisory
- Release NotesThird Party Advisory
- ExploitThird Party Advisory
- https://user-images.githubusercontent.com/9525971/142965091-e118b012-a7fc-4c2f-ad0c-80aeed6f7ec9.pngThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 6.18.0 (включая)
cpe:2.3:a:ericsson:codechecker:*:*:*:*:*:*:*:*
EPSS
Процентиль: 73%
0.00741
Низкий
6.1 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-79
Связанные уязвимости
EPSS
Процентиль: 73%
0.00741
Низкий
6.1 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-79