MITRE CALDERA 4.1.0 allows stored XSS via app.contact.gist (aka the gist contact configuration field), leading to execution of arbitrary commands on agents.
oryginał ENCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NMitre Caldera
APPMitre< 4.1.0
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
XSS
Powiązane podatności
CVE-2021-42560HIGH8.8ten sam produkt
An issue was discovered in CALDERA 2.9.0. The Debrief plugin receives base64 encoded "SVG" parameters when gen...
CVE-2021-42562HIGH8.1ten sam produkt
An issue was discovered in CALDERA 2.8.1. It does not properly segregate user privileges, resulting in non-adm...
CVE-2021-42561HIGH8.8ten sam produkt
An issue was discovered in CALDERA 2.8.1. When activated, the Human plugin passes the unsanitized name paramet...
CVE-2021-42559HIGH8.8ten sam produkt
An issue was discovered in CALDERA 2.8.1. It contains multiple startup "requirements" that execute commands wh...
CVE-2020-19907HIGH8.8ten sam produkt
A command injection vulnerability in the sandcat plugin of Caldera 2.3.1 and earlier allows authenticated atta...