漏洞标题
N/A
漏洞描述信息
Tufin SecureTrack < R20-2 GA 包含反射加存储的 XSS(即，该值将反射回用户，但也存储在 DB 中，并可以稍后由相同的受害者再次触发，或者由不同的用户稍后触发)。存储和反射的元数据都可以由管理员触发，所以恶意未验证的用户可以获得管理员权限。甚至恶意低特权用户可以注入 XSS，该注入可以被管理员执行， potentially 提升特权并获取管理员权限。(第 2 个问题)
CVSS信息
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users). Both stored, and reflected payloads are triggerable by admin, so malicious non-authenticated user could get admin level access. Even malicious low-privileged user can inject XSS, which can be executed by admin, potentially elevating privileges and obtaining admin access. (issue 2 of 3)
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
Tufin SecureTrack R20-2 GA 跨站脚本漏洞
漏洞描述信息
Tufin SecureTrack R20-2 GA中存在跨站脚本漏洞，该漏洞源于WEB应用缺少对客户端数据的正确验证。攻击者可利用该漏洞执行客户端代码。
CVSS信息
N/A
漏洞类别
跨站脚本