CVE-2019-25277: fallo de gravedad media en iWT Ltd. FaceSentry Access Control System
FaceSentry Access Control System 6.4.8 Reflected Cross-Site Scripting via pluginInstall.php
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.1epss 0.3%
FaceSentry Access Control System 6.4.8 contains a cross-site scripting vulnerability in the 'msg' parameter of pluginInstall.php that allows attackers to inject malicious scripts. Attackers can exploit the unvalidated input to execute arbitrary JavaScript in victim browsers, potentially stealing authentication credentials and conducting phishing attacks.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Productos afectados
iWT Ltd. · FaceSentry Access Control SystemCVEs relacionadas — iWT Ltd. FaceSentry Access Control System
En el mismo producto, de las más peligrosas a las menos.
CVE-2019-25243HIGHFaceSentry 6.4.8 Authenticated Remote Command Injection via Ping TestEPSS 2.6%CVE-2019-25241CRITICALFaceSentry Access Control System 6.4.8 Remote SSH Root AccessEPSS 0.7%CVE-2019-25278CRITICALFaceSentry Access Control System 6.4.8 Authentication Credentials MiTM DisclosureEPSS 0.3%CVE-2019-25242MEDIUMFaceSentry Access Control System 6.4.8 Cross-Site Request Forgery via Web InterfaceEPSS 0.2%CVE-2019-25279MEDIUMFaceSentry Access Control System 6.4.8 Cleartext Password Storage VulnerabilityEPSS 0.2%