Security Advisories on CIRCL

CVE-2015-1035 - Vulnerability in HRIS software (HRMS product) - Reflective XSS

Mon, 01 Jan 0001 00:00:00 +0000

Reflective Cross Site Scripting in HRIS software (HRMS product)

A vulnerability in the HRIS software (HRMS product) leads to a reflective cross site scripting.

Details about vulnerability

There is an improper neutralization of input during web page generation in the F_NavForm parameter.

Version vulnerable

Versions belows 4.17 are vulnerable. This vulnerability is fixed in version 4.17.

Fixes

We are not aware of any fixes. The vendor was contacted the 9th January 2015 for more information.

CVE-2015-1036 - Vulnerability in HRIS software (HRMS product) - SQL injection (as an authenticated user)

Mon, 01 Jan 0001 00:00:00 +0000

Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)

A vulnerability in the HRIS software (HRMS product) leads to an SQL injection, if the user is authenticated.

Details about vulnerability

Input elements used by /WrkFlw.aspx are not neutralized or incorrectly neutralizes the input that can sent unwanted SQL commands to the downstream component.

Version vulnerable

Versions belows 4.17 are vulnerable. This vulnerability is fixed in version 4.17.

CVE-2015-4099 - SysAid "Service Desk" - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Mon, 01 Jan 0001 00:00:00 +0000

Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’)

SysAid “Service Desk” can be instrumented to gain access to the underlying database, which usually means accessing the MSSQL server with the Administrator account (‘sa’).

Details about vulnerability

The “dir” parameter while posting to “/EndUserActions.jsp” is prone to a blind SQL injection.

Version vulnerable

SysAid “Service Desk” cloud versions prior to 15.1.70 are affected by this vulnerability. SysAid “Service Desk” on-premise versions prior to 15.2 are affected by this vulnerability.

CVE-2015-5719 - Vulnerability in MISP - Incorrect validation of temporary filenames

Mon, 01 Jan 0001 00:00:00 +0000

Incorrect validation of temporary filenames

A bug in MISP introduces an unsafe temporary file creation vulnerability.

Fixes

MISP versions below 2.3.92 are vulnerable. This vulnerability is fixed in version 2.3.92.

CVE

CVE-2015-5719

Acknowledgement

CIRCL would like to thank the reporter (Davy Stoffel from Conostix) for his security review.

Classification of this document

TLP:CLEAR information may be distributed without restriction, subject to copyright controls.

Revision

Version 1.0 - TLP:CLEAR - First version (20150804)

CVE-2015-5720 - Vulnerability in MISP - XSS in template creation

Mon, 01 Jan 0001 00:00:00 +0000

Incorrect validation of temporary filenames

A bug in MISP introduces a potential XSS (Cross-site scripting) in the template creation.

Fixes

MISP versions below 2.3.90 are vulnerable. This vulnerability is fixed in version 2.3.90.

CVE

CVE-2015-5720

Acknowledgement

CIRCL would like to thank the reporter (Davy Stoffel from Conostix) for his security review.

Classification of this document

TLP:CLEAR information may be distributed without restriction, subject to copyright controls.

Revision

Version 1.0 - TLP:CLEAR - First version (20150804)

CVE-2015-5721 - Vulnerability in MISP - potential PHP Object injection vulnerability

Mon, 01 Jan 0001 00:00:00 +0000

Incorrect validation of temporary filenames

A bug in MISP introduces a potential PHP Object injection vulnerability from a user input.

Fixes

MISP versions below 2.3.90 are vulnerable. This vulnerability is fixed in version 2.3.90.

CVE

CVE-2015-5721

Acknowledgement

CIRCL would like to thank the reporter (Davy Stoffel from Conostix) for his security review.

Classification of this document

TLP:CLEAR information may be distributed without restriction, subject to copyright controls.

Revision

Version 1.0 - TLP:CLEAR - First version (20150804)

CVE-2017-13671 - Vulnerability in MISP and Threat Sharing - potential persistent cross site scripting vulnerability in the comments

Mon, 01 Jan 0001 00:00:00 +0000

Cross site scripting vulnerability in the comments

In MISP 2.4.78 (and below), a MISP user having access to a MISP instance can inject JavaScript in a comment field, aka XSS.

The comment field is not part of the MISP synchronisation and only impacts the users of the same instance.

Fixes

MISP versions below 2.4.79 are vulnerable. This vulnerability is fixed in version 2.4.79.

CVE

CVE-2017-13671

Acknowledgement

CIRCL would like to thank the reporters Jurgen Jans and Cedric Van Bockhaven from Deloitte.

CVE-2017-14337 - Vulnerability in MISP and Threat Sharing - Vulnerability in CertAuth module when used with external user management API

Mon, 01 Jan 0001 00:00:00 +0000

Vulnerability in CertAuth module when used with external user management API

When MISP is configured with X.509 certificate authentication (CertAuth) in conjunction with a non-MISP external user management ReST API, if an external user provides X.509 certificate authentication and this API returns an empty value, the unauthenticated user can be granted access as an arbitrary user.

Impact

The impact of this vulnerability is very low as the vulnerability highly depends of the external user-management used in conjunction with the X.509 certificate authentication.