CVE-2019-17551 Cross-site scripting in n/a
An authenticated attacker can inject malicious scripts via the Notes section, potentially leading to session hijacking or code execution in the victim's browser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-17551?
CVE-2019-17551 is a medium-severity cross-site scripting vulnerability in n/a, published on 31 Oct 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.5, an attacker can send an authenticated POST request with a malicious payload to /WFS/agreementView.faces allowing a stored XSS via the mainForm:loanNotesnotes:0:rich_text_editor_note_text parameter in the Notes section. Although versions 6.31.8.3 and 6.31.8.5 are confirmed to be affected, all versions with the vulnerable WYSIWYG editor in the Notes section are likely affected.
Weakness: CWE-79
Which versions are affected by CVE-2019-17551?
It affects 1 product.
Products include Apakgroup Wholesale Floorplanning Finance.
How do I fix CVE-2019-17551?
No fix has been published for CVE-2019-17551 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2019-17551 being exploited?
There is no known exploitation of CVE-2019-17551 in the wild and no public exploit code.
Sources
Also known as GHSA-rr4c-478q-qv5r.