Vulners
Lucene search
Adobe Connect 9.3 Cross Site Scripting
| Reporter | Title | Published | Views | Family All 9 |
|---|---|---|---|---|
 | Adobe Connect 'admin/home/homepage/search' Cross-Site Scripting Vulnerability | 17 Jun 201500:00 | – | cnvd |
 | CVE-2015-0343 | 13 Jun 201515:00 | – | cve |
 | CVE-2015-0343 | 13 Jun 201515:00 | – | cvelist |
 | EUVD-2015-0356 | 7 Oct 202500:30 | – | euvd |
 | CVE-2015-0343 | 13 Jun 201515:59 | – | nvd |
 | Adobe Connect < 9.4 Multiple Vulnerabilities | 19 Jun 201500:00 | – | openvas |
 | Cross site scripting | 13 Jun 201515:59 | – | prion |
 | XSS vulnerability Adobe Connect 9.3 (CVE-2015-0343 ) | 14 Jun 201500:00 | – | securityvulns |
| Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl) | 14 Jun 201500:00 | – | securityvulns |
`Advisory: Adobe Connect Reflected XSS
Author: Stas Volfus (Bugsec Information Security LTD)
Vendor URL: http://www.adobe.com/
Status: Vendor Notified
==========================
Vulnerability Description
==========================
Adobe Connect (Central) version: 9.3 is vulnerable to Reflected XSS (Cross Site Scripting).
The attack allows execution of arbitrary JavaScript in the context of the users browser.
CVE id: CVE-2015-0343 assigned for this issue.
==========================
PoC
==========================
The following URL demonstrates the vulnerability:
https://vulnerablewebsite.com/admin/home/homepage/search?account-id=1&filter-rows=1&filter-start=0&now=yes&query=<a href="javascript:alert('XSS')">XSS Link</a>
==========================
Disclosure Timeline
==========================
04-NOV-2014 - Vendor notified
01-DEC-2014 - CVE assigned
27-MAR-2015 - Resolved by vendor, fix deployed on Adobe Connect 9.4.
==========================
References
==========================
http://www.adobe.com/il_en/products/adobeconnect.html
https://helpx.adobe.com/adobe-connect/release-note/connect-94-release-notes.html
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
11 Jun 2015 00:00Current
0.1Low risk
Vulners AI Score0.1
EPSS0.00653