CVE-2019-7671

🗓️ 05 Jun 2019 18:53:12Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 85 Views🌐 WEB

Prima Systems FlexAir, Versions 2.3.38 and prior. Parameters sent to scripts are not properly sanitized before being returned to the user, which may allow an attacker to execute arbitrary code in a user’s browser session in context of an affected site

Reporter	Title	Published	Views	Family All 11
0day.today	Prima Access Control 2.3.35 - (HwName) Persistent Cross-Site Scripting Vulnerability	12 Nov 201900:00	–	zdt
Cvelist	CVE-2019-7671	5 Jun 201918:53	–	cvelist
Exploit DB	Prima Access Control 2.3.35 - 'HwName' Persistent Cross-Site Scripting	12 Nov 201900:00	–	exploitdb
EUVD	EUVD-2019-17203	7 Oct 202500:30	–	euvd
exploitpack	Prima Access Control 2.3.35 - HwName Persistent Cross-Site Scripting	12 Nov 201900:00	–	exploitpack
ICS	Prima Systems FlexAir	30 Jul 201900:00	–	ics
NVD	CVE-2019-7671	5 Jun 201919:29	–	nvd
Packet Storm	Prima Access Control 2.3.35 Cross Site Scripting	12 Nov 201900:00	–	packetstorm
Prion	Design/Logic Flaw	5 Jun 201919:29	–	prion
Positive Technologies	PT-2019-18694 · Prima Systems · Flexair	5 Jun 201900:00	–	ptsecurity

NVD

Node

primasystems flexairRange≤2.3.38

Source	Link
applied-risk	www.applied-risk.com/index.php/download_file/view/199/165
packetstormsecurity	www.packetstormsecurity.com/files/155274/Prima-Access-Control-2.3.35-Cross-Site-Scripting.html
us-cert	www.us-cert.gov/ics/advisories/icsa-19-211-02
applied-risk	www.applied-risk.com/labs/advisories
applied-risk	www.applied-risk.com/resources/ar-2019-007

Parameter	Position	Path	Description	CWE
HwName	nested	/bin/sysfcgi.fx	Stored XSS via unsanitized parameter echoed back in response (XML/param value)	CWE-79

21 Nov 2024 04:48Current

7.7High risk

Vulners AI Score7.7

CVSS 23.5

CVSS 3.19

EPSS0.13066

CWE-79