CVE-2019-1568 Cross Site Scripting (XSS) in Demisto
Attack Vector NETWORK
Scope CHANGED
Attack Complexity LOW
Confidentiality Impact LOW
Privileges Required NONE
Integrity Impact LOW
User Interaction REQUIRED
Availability Impact NONE
Description
A cross-site scripting (XSS) vulnerability exists in the Palo Alto Networks Demisto. (Ref CVE-2019-1568)
Successful exploitation of this issue may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML.
This issue affects Demisto 4.5 build 40249
Product Status
| Versions | Affected | Unaffected |
|---|---|---|
| Demisto 4.5 | >= 40249, < 40589 | >= 40589 |
Severity:MEDIUM
CVSSv3.1 Base Score:6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness Type
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Solution
Demisto 4.5 build 40589
Workarounds and Mitigations
N/A
Acknowledgments
Palo Alto Networks would like to thank Mihalis Haatainen and Tomi Lindfors of Optimesys for reporting this issue.