WEMS Enterprise Manager 2.58 (email) Reflected XSS

🗓️ 29 Dec 2019 00:00:00Reported by Gjoko KrsticType

zeroscience🔗 www.zeroscience.mk👁 67 Views

WEMS EM 2.58 XSS via Email Paramete

Reporter	Title	Published	Views	Family All 7
CNNVD	packetstormsecurity WEMS Enterprise Manager 跨站脚本漏洞	28 Apr 202100:00	–	cnnvd
CVE	CVE-2020-21993	28 Apr 202114:46	–	cve
Cvelist	CVE-2020-21993	28 Apr 202114:46	–	cvelist
EUVD	EUVD-2020-14759	7 Oct 202500:30	–	euvd
NVD	CVE-2020-21993	28 Apr 202115:15	–	nvd
Prion	Design/Logic Flaw	28 Apr 202115:15	–	prion
RedhatCVE	CVE-2020-21993	22 May 202515:19	–	redhatcve

<html><body><p>WEMS Enterprise Manager 2.58 (email) Reflected XSS


Vendor: WEMS Limited
Product web page: https://www.wems.co.uk
Affected version: 2.58.8903
                  2.55.8806
                  2.55.8782
                  2.19.7959

Summary: WEMS Enterprise Manager is a centralised management and monitoring
system for many WEMS equipped sites. It retrieves and stores data to enable
energy analysis at an enterprise wide level. It is designed to give global
visibility of the key areas that affect a buildings' environmental and energy
performance using site data collected via WEMS Site Managers or Niagara compatible
hardware.

Desc: Input passed to the GET parameter 'email' is not properly sanitised before
being returned to the user. This can be exploited to execute arbitrary HTML code
in a user's browser session in context of an affected site.

Tested on: Linux
           PHP


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2019-5551
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5551.php


06.07.2019

--


https://192.168.1.244/guest/users/forgotten?email="&gt;<script>confirm(251)</script>
</p></body></html>

29 Dec 2019 00:00Current

6.6Medium risk

Vulners AI Score6.6

CVSS 24.3

CVSS 3.16.1

EPSS0.0024