CVE-2019-19393 Cross-site scripting in n/a
Persistent XSS in Rittal CMC PU III web interface allows attackers to inject scripts, modify content, or hijack sessions via the system configuration page.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-19393?
CVE-2019-19393 is a medium-severity cross-site scripting vulnerability in n/a, published on 1 Oct 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.00_2 to V3.15.70_4 devices fails to sanitize user input on the system configurations page. This allows an attacker to backdoor the device with HTML and browser-interpreted content (such as JavaScript or other client-side scripts) as the content is always displayed after and before login. Persistent XSS allows an attacker to modify displayed content or to change the victim's information. Successful exploitation requires access to the web management interface, either with valid credentials or a hijacked session.
Weakness: CWE-79
Which versions are affected by CVE-2019-19393?
It affects 1 product.
Products include Rittal Cmc Pu Iii 7030.000 Firmware.
How do I fix CVE-2019-19393?
No fix has been published for CVE-2019-19393 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2019-19393 being exploited?
There is no known exploitation of CVE-2019-19393 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-4xrr-ph69-m596.