Versiant LYNX Customer Service Portal is vulnerable to stored cross-site scripting

guest · Mar 31, 2020

Versiant LYNX Customer Service Portal is vulnerable to stored cross-site scripting
Vulnerability Note VU#962085
March 30, 2020
https://kb.cert.org/vuls/id/962085/

Overview
The Versiant LYNX Customer Service Portal version 3.5.2 is vulnerable to stored cross-site scripting, which may allow a local, authenticated attacker to execute arbitrary JavaScript.
Description
The Versiant LYNX Customer Service Portal (CSP) is a "full-service customer portal that provides real-time information to terminal operators on the status of shipments into and out of a marine container terminal". The LYNX CSP, version 3.5.2, is vulnerable to stored cross-site scripting, which could allow a local, authenticated attacker to insert malicious JavaScript that is stored and displayed to the end user.
Impact
A local, authenticated attacker could store malicious JavaScript in the CSP that would execute JavaScript in the browser of any user that views it. This could lead to website redirects, session cookie hijacking, or information disclosure.
Click to expand...

Solution
Apply an update
This vulnerability has been patched in version 3.5.3 of Versiant LYNX Customer Service Portal. Customers should log into the Lynx customer portal to obtain the latest version.

CVSS Metrics
Base 3.2 AV:L/AC:L/Au:S/C:N/I:P/A:P
CVE IDs: CVE-2020-9055
Click to expand...

Log in or Sign up

Versiant LYNX Customer Service Portal is vulnerable to stored cross-site scripting

guest Guest

Log in or Sign up

Versiant LYNX Customer Service Portal is vulnerable to stored cross-site scripting

guest Guest

Useful Searches