A missing origin validation in WebSockets vulnerability affects the GraphicalData web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It might allow a remote attacker to lure a successfully authenticated user to a malicious website. This vulnerability only affects the following two endpoints: GraphicalData/js/signalR/connect and GraphicalData/js/signalR/reconnect.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:ClearArcinformatique Pcvue
APPArcinformatique12.0.0 β 15.2.1316.0.0 β 16.3.4 (bez)
Related vulnerabilities
The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue...
The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by...
A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15...
An XSS vulnerability affects the OAuth web services used by the WebVue, WebScheduler, TouchVue and SnapVue fea...
An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2....