CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS
Percentile
52.5%
TestRail version 3.1.1.3130 contains a cross-site scripting vulnerability.
CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
Gurock Software TestRail version 3.1.1.3130 contains a stored cross-site scripting vulnerability. The Created By
field in project activities is vulnerable to script injection.
A remote attacker may be able to execute arbitrary script in the context of the end-user’s browser session.
Apply a Patch
Gurock Software has released an update (Testrail 3.1.3) addressing this vulnerability.
669804
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Notified: July 18, 2014 Updated: July 24, 2014
Affected
All TestRail Hosted accounts (the cloud/SaaS edition of TestRail) have already been updated automatically by the vendor. All TestRail on-premise customers can download the new version from the customer portal and follow the upgrade instructions as usual.
The vulnerability can only be taken advantage of by actual users with existing TestRail access. Persons without access to TestRail cannot inject any code using this vulnerability or access any information or data without permissions.
We are not aware of further vendor information regarding this vulnerability.
Group | Score | Vector |
---|---|---|
Base | 5 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Temporal | 4.1 | E:F/RL:OF/RC:C |
Environmental | 0 | CDP:N/TD:N/CR:ND/IR:ND/AR:ND |
Thanks to the reporter who wishes to remain anonymous.
This document was written by Chris King.
CVE IDs: | CVE-2014-4857 |
---|---|
Date Public: | 2014-07-24 Date First Published: |