cnvd - cnvd-2019-36961

CNVD-2019-36961

Vulnerability from cnvd - Published: 2019-10-24

Title

HCL Traveler跨站脚本漏洞

Description

HCL Traveler是一款实时同步邮件、日历和地址簿数据等的软件。 HCL Traveler 9.x及之前版本中存在跨站脚本漏洞，该漏洞源于WEB应用缺少对客户端数据的正确验证，攻击者可利用该漏洞执行客户端代码。

Severity

中

Patch Name

HCL Traveler跨站脚本漏洞的补丁

Patch Description

HCL Traveler是一款实时同步邮件、日历和地址簿数据等的软件。 HCL Traveler 9.x及之前版本中存在跨站脚本漏洞，该漏洞源于WEB应用缺少对客户端数据的正确验证，攻击者可利用该漏洞执行客户端代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://hclpnpsupport.hcltech.com/csm?id=kb_article&sysparm_article=KB0073231

Reference

https://hclpnpsupport.hcltech.com/csm?id=kb_article&sysparm_article=KB0073231 https://nvd.nist.gov/vuln/detail/CVE-2019-4409

Impacted products

Name
hcltech HCL Traveler <=9.*

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-4409",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-4409"
    }
  },
  "description": "HCL Traveler\u662f\u4e00\u6b3e\u5b9e\u65f6\u540c\u6b65\u90ae\u4ef6\u3001\u65e5\u5386\u548c\u5730\u5740\u7c3f\u6570\u636e\u7b49\u7684\u8f6f\u4ef6\u3002\n\nHCL Traveler 9.x\u53ca\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eWEB\u5e94\u7528\u7f3a\u5c11\u5bf9\u5ba2\u6237\u7aef\u6570\u636e\u7684\u6b63\u786e\u9a8c\u8bc1\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u5ba2\u6237\u7aef\u4ee3\u7801\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://hclpnpsupport.hcltech.com/csm?id=kb_article\u0026sysparm_article=KB0073231",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-36961",
  "openTime": "2019-10-24",
  "patchDescription": "HCL Traveler\u662f\u4e00\u6b3e\u5b9e\u65f6\u540c\u6b65\u90ae\u4ef6\u3001\u65e5\u5386\u548c\u5730\u5740\u7c3f\u6570\u636e\u7b49\u7684\u8f6f\u4ef6\u3002\r\n\r\nHCL Traveler 9.x\u53ca\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eWEB\u5e94\u7528\u7f3a\u5c11\u5bf9\u5ba2\u6237\u7aef\u6570\u636e\u7684\u6b63\u786e\u9a8c\u8bc1\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u5ba2\u6237\u7aef\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "HCL Traveler\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "hcltech HCL Traveler \u003c=9.*"
  },
  "referenceLink": "https://hclpnpsupport.hcltech.com/csm?id=kb_article\u0026sysparm_article=KB0073231\r\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-4409",
  "serverity": "\u4e2d",
  "submitTime": "2019-10-18",
  "title": "HCL Traveler\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e"
}

CVE-2019-4409 (GCVE-0-2019-4409)

Vulnerability from cvelistv5 – Published: 2019-10-18 19:28 – Updated: 2024-08-04 19:33

Summary

HCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks. On the Problem Report page of the Traveler servlet pages, there is a field to specify a file attachment to provide additional problem details. An invalid file name returns an error message that includes the entered file name. If the file name is not escaped in the returned error page, it could expose a cross-site scripting (XSS) vulnerability.

Severity ?

No CVSS data available.

CWE

Cross-site scripting

Assigner

HCL

References

URL

Tags

https://hclpnpsupport.hcltech.com/csm?id=kb_artic…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	HCL	HCL Traveler	Affected: 9.x and earlier versions

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T19:33:38.071Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://hclpnpsupport.hcltech.com/csm?id=kb_article\u0026sysparm_article=KB0073231"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "HCL Traveler",
          "vendor": "HCL",
          "versions": [
            {
              "status": "affected",
              "version": "9.x and earlier versions"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "HCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks. On the Problem Report page of the Traveler servlet pages, there is a field to specify a file attachment to provide additional problem details. An invalid file name returns an error message that includes the entered file name. If the file name is not escaped in the returned error page, it could expose a cross-site scripting (XSS) vulnerability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-23T21:02:24",
        "orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc",
        "shortName": "HCL"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://hclpnpsupport.hcltech.com/csm?id=kb_article\u0026sysparm_article=KB0073231"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@hcl.com",
          "ID": "CVE-2019-4409",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "HCL Traveler",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "9.x and earlier versions"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "HCL"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "HCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks. On the Problem Report page of the Traveler servlet pages, there is a field to specify a file attachment to provide additional problem details. An invalid file name returns an error message that includes the entered file name. If the file name is not escaped in the returned error page, it could expose a cross-site scripting (XSS) vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://hclpnpsupport.hcltech.com/csm?id=kb_article\u0026sysparm_article=KB0073231",
              "refsource": "CONFIRM",
              "url": "https://hclpnpsupport.hcltech.com/csm?id=kb_article\u0026sysparm_article=KB0073231"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc",
    "assignerShortName": "HCL",
    "cveId": "CVE-2019-4409",
    "datePublished": "2019-10-18T19:28:38",
    "dateReserved": "2019-01-03T00:00:00",
    "dateUpdated": "2024-08-04T19:33:38.071Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2019-36961

CVE-2019-4409 (GCVE-0-2019-4409)

Tags

Sightings

Nomenclature