CVE-2019-25277: falha de média gravidade em iWT Ltd. FaceSentry Access Control System
FaceSentry Access Control System 6.4.8 Reflected Cross-Site Scripting via pluginInstall.php
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.1epss 0.3%
FaceSentry Access Control System 6.4.8 contains a cross-site scripting vulnerability in the 'msg' parameter of pluginInstall.php that allows attackers to inject malicious scripts. Attackers can exploit the unvalidated input to execute arbitrary JavaScript in victim browsers, potentially stealing authentication credentials and conducting phishing attacks.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
iWT Ltd. · FaceSentry Access Control SystemCVEs relacionadas — iWT Ltd. FaceSentry Access Control System
No mesmo produto, das mais perigosas para as menos.
CVE-2019-25243HIGHFaceSentry 6.4.8 Authenticated Remote Command Injection via Ping TestEPSS 2.6%CVE-2019-25241CRITICALFaceSentry Access Control System 6.4.8 Remote SSH Root AccessEPSS 0.7%CVE-2019-25278CRITICALFaceSentry Access Control System 6.4.8 Authentication Credentials MiTM DisclosureEPSS 0.3%CVE-2019-25242MEDIUMFaceSentry Access Control System 6.4.8 Cross-Site Request Forgery via Web InterfaceEPSS 0.2%CVE-2019-25279MEDIUMFaceSentry Access Control System 6.4.8 Cleartext Password Storage VulnerabilityEPSS 0.2%