Kerweb / Kerwin Cross Site Scripting

2012.05.06
Credit: phocean
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

Kerweb/Kerwin XSS vulnerabilities Severity: Moderate Vendor: Schneider Electrics Versions Affected: Kerweb < 3.0.1 Kerwin < 6.0.1 Description: Input fields used for searching and displaying content are not filtered properly. Thus, the web application suffers from multiple reflected XSS vulnerabilities. Exploitation is made easier as parameters are passed with GET HTTP method. Example: An URL can be forged by injecting code in one of the parameter, like 'evtvariablename' here: http://<server>/kw.dll?page=evts.xml&sessionid=xxx&nomenu=&typeevtwin=alms&dt=&gtvariablevalue=&ltvariablevalue=&variablevalue=&nevariablevalue=&evtclass=&evtdevicezone=&evtdevicecountry=&evtdeviceregion=&evtstatustype=&evtseveritytype=&evtstatus=&evtseverity=&evtlevel=&gtdateapp=&ltdateapp=&gtdaterec=&ltdaterec=&evtvariablename="</script><script>alert(1)</script>"&evtdevicename=&evtnature=&evttype=&gtduration=&ltduration=&gtdurationvalue=&gtdurationwide=1&ltdurationvalue=&ltdurationwide=1 Vendor status: Vendor was contacted and a fix was released (with Kerweb 3.0.1 and Kerwin 6.0.1) Mitigation: Upgrade to Kerweb 3.0.1 and Kerwin 6.0.1 CVE: CVE-2012-1990 Timeline: 06/20/2011: vendor disclosure (ticket reference : KN10915) 07/22/2011: vendor response 09/01/2012: fix released 05/05/2012: public disclosure --- phocean


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top