[FD] [CVE-2017-10798] ObjectPlanet Opinio 7.6.3 Cross-Site Scripting (XSS)

[Kasper Karlsson <Kasper.Karlsson@xxxxxxxxxxxxx>]

Vendor: ObjectPlanet

Product: Opinio

Version: Up to 7.6.3 (inclusive)

Homepage: http://www.objectplanet.com/opinio/

CVE: CVE-2017-10798



Description

================

Reflected XSS vulnerability in ObjectPlanet Opinio up to version 7.6.3.



Vulnerability

================

The /admin/reportPortal.do page is vulnerable to reflected XSS attacks through 
the userLanguage GET parameter. This page is available to remote, 
unauthenticated users.



Proof of concept

================

https://localhost/admin/reportPortal.do?userLanguage=%22%3E%3C/script%3E%3Cscript%3Ealert(1);//



Mitigations

================

Upgrade to version 7.6.4 or later.



References

================

https://gist.github.com/kasperkarlsson/da24c64a5b56ff20059e31f74b2a19ac

http://www.objectplanet.com/opinio/changelog.html



Timeline

================

2017-03-31 Vulnerability discovered

2017-04-01 Asked vendor how they prefer to receive vulnerability reports

2017-04-03 First response from vendor

2017-04-04 PoC sent to vendor

2017-04-05 Vendor confirms vulnerability. Patch will be included in next 
release within a few weeks.

2017-04-20 Patch released in version 7.6.4 - "Improved: Fixed some cross-site 
scripting vulnerabilities." http://www.objectplanet.com/opinio/changelog.html

2017-07-02 CVE Requested and received - "Use CVE-2017-10798."

2017-07-09 Public disclosure



Discovered by Kasper Karlsson

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/