Vulners
Lucene search
Yellowfin Cross Site Scripting / Insecure Direct Object Reference
🗓️ 14 Oct 2021 00:00:00Reported by Michele Di BonaventuraType 
packetstorm🔗 packetstormsecurity.com👁 311 Views
| Reporter | Title | Published | Views | Family All 37 |
|---|---|---|---|---|
 | Yellowfin Cross Site Scripting / Insecure Direct Object Reference Vulnerabilities | 14 Oct 202100:00 | – | zdt |
 | CVE-2021-36388 | 14 Oct 202119:15 | – | attackerkb |
| CVE-2021-36389 | 14 Oct 202119:15 | – | attackerkb |
| CVE-2021-36387 | 14 Oct 202119:15 | – | attackerkb |
 | CVE-2021-36387 | 14 Oct 202122:27 | – | circl |
| CVE-2021-36388 | 14 Oct 202122:27 | – | circl |
| CVE-2021-36389 | 14 Oct 202122:27 | – | circl |
 | Yellowfin Business Intelligence Yellowfin 代码注入漏洞 | 14 Oct 202100:00 | – | cnnvd |
| Yellowfin Business Intelligence Yellowfin 安全漏洞 | 14 Oct 202100:00 | – | cnnvd |
| Yellowfin Business Intelligence Yellowfin 跨站脚本漏洞 | 14 Oct 202100:00 | – | cnnvd |
10
`YELLOWFIN < 9.6.1 MULTIPLE VULNERABILITIES
----------------------------------------------------
Vulnerability:
==============
Stored Cross-Site Scripting
Affected Products and Versions:
===============================
Yellowfin < 9.6.1
CVEID:
======
CVE-2021-36387
CVSSv3.1 Score:
===============
5.4 (Medium)
CVSSv3.1 Attack Vector:
=======================
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Short Description:
==================
In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploitable through a specially crafted HTTP POST request to the page "ActivityStreamAjax.i4".
Remediation:
============
Update Yellowfin to the latest version available
Discoverer:
===========
Michele Di Bonaventura (cyberaz0r)
Reference:
==========
https://wiki.yellowfinbi.com/display/yfcurrent/Release+Notes+for+Yellowfin+9#ReleaseNotesforYellowfin9-Yellowfin9.6
----------------------------------------------------
Vulnerability:
==============
Insecure Direct Object Reference
Affected Products and Versions:
===============================
Yellowfin < 9.6.1
CVEID:
======
CVE-2021-36388
CVSSv3.1 Score:
===============
7.5 (High)
CVSSv3.1 Attack Vector:
=======================
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Short Description:
==================
In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIIAvatarImage.i4".
Remediation:
============
Update Yellowfin to the latest version available
Discoverer:
===========
Michele Di Bonaventura (cyberaz0r)
Reference:
==========
https://wiki.yellowfinbi.com/display/yfcurrent/Release+Notes+for+Yellowfin+9#ReleaseNotesforYellowfin9-Yellowfin9.6
----------------------------------------------------
Vulnerability:
==============
Insecure Direct Object Reference
Affected Products and Versions:
===============================
Yellowfin < 9.6.1
CVEID:
======
CVE-2021-36389
CVSSv3.1 Score:
===============
7.5 (High)
CVSSv3.1 Attack Vector:
=======================
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Short Description:
==================
In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIImage.i4".
Remediation:
============
Update Yellowfin to the latest version available
Discoverer:
===========
Michele Di Bonaventura (cyberaz0r)
Reference:
==========
https://wiki.yellowfinbi.com/display/yfcurrent/Release+Notes+for+Yellowfin+9#ReleaseNotesforYellowfin9-Yellowfin9.6
----------------------------------------------------
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
14 Oct 2021 00:00Current
6.4Medium risk
Vulners AI Score6.4
EPSS0.03085