CVE-2019-17120

A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/adm_usrs.jsp. The usr parameter is vulnerable: the reflected cross-site scripting occurs immediately after the user is created. The malicious script is stored and will be executed whenever /WiKIDAdmin/adm_usrs.jsp is visited.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 90%
VendorProductVersion
wikidsystems2fa_enterprise_server
3.4.81:b676
wikidsystems2fa_enterprise_server
3.4.85:b780
wikidsystems2fa_enterprise_server
3.4.87:b1092
wikidsystems2fa_enterprise_server
3.4.87:b1159
wikidsystems2fa_enterprise_server
3.4.87:b1169
wikidsystems2fa_enterprise_server
3.4.87:b1216
wikidsystems2fa_enterprise_server
3.4.87:b824
wikidsystems2fa_enterprise_server
3.4.87:b839
wikidsystems2fa_enterprise_server
3.5.0:b1342
wikidsystems2fa_enterprise_server
3.5.0:b1352
wikidsystems2fa_enterprise_server
3.5.0:b1359
wikidsystems2fa_enterprise_server
3.5.0:b1373
wikidsystems2fa_enterprise_server
3.5.0:b1403
wikidsystems2fa_enterprise_server
3.5.0:b1411
wikidsystems2fa_enterprise_server
3.5.0:b1421
wikidsystems2fa_enterprise_server
3.5.0:b1428
wikidsystems2fa_enterprise_server
3.5.0:b1438
wikidsystems2fa_enterprise_server
3.5.0:b1472
wikidsystems2fa_enterprise_server
3.5.0:b1542
wikidsystems2fa_enterprise_server
3.5.0:b1580
wikidsystems2fa_enterprise_server
3.6.0:b1659
wikidsystems2fa_enterprise_server
3.6.0:b1672
wikidsystems2fa_enterprise_server
4.0:b1787
wikidsystems2fa_enterprise_server
4.0:b1798
wikidsystems2fa_enterprise_server
4.0:b1803
wikidsystems2fa_enterprise_server
4.0.1:b1817
wikidsystems2fa_enterprise_server
4.0.1:b1821
wikidsystems2fa_enterprise_server
4.0.1:b1905
wikidsystems2fa_enterprise_server
4.0.1:b1906
wikidsystems2fa_enterprise_server
4.0.2:b1917
wikidsystems2fa_enterprise_server
4.0.2:b1921
wikidsystems2fa_enterprise_server
4.1.0:b1926
wikidsystems2fa_enterprise_server
4.1.0:b1941
wikidsystems2fa_enterprise_server
4.1.0:b1949
wikidsystems2fa_enterprise_server
4.1.0:b1955
wikidsystems2fa_enterprise_server
4.2.0:b1978
wikidsystems2fa_enterprise_server
4.2.0:b1981
wikidsystems2fa_enterprise_server
4.2.0:b1984
wikidsystems2fa_enterprise_server
4.2.0:b2007
wikidsystems2fa_enterprise_server
4.2.0:b2014
wikidsystems2fa_enterprise_server
4.2.0:b2016
wikidsystems2fa_enterprise_server
4.2.0:b2020
wikidsystems2fa_enterprise_server
4.2.0:b2023
wikidsystems2fa_enterprise_server
4.2.0:b2028
wikidsystems2fa_enterprise_server
4.2.0:b2032
wikidsystems2fa_enterprise_server
4.2.0:b2047
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/154912/WiKID-Systems-2FA-Enterprise-Server-4.2.0-b2032-SQL-Injection-XSS-CSRF.html
http://seclists.org/fulldisclosure/2019/Oct/35
https://www.securitymetrics.com/blog/wikid-2fa-enterprise-server-cross-site-scripting
http://packetstormsecurity.com/files/154912/WiKID-Systems-2FA-Enterprise-Server-4.2.0-b2032-SQL-Injection-XSS-CSRF.html
http://seclists.org/fulldisclosure/2019/Oct/35
https://www.securitymetrics.com/blog/wikid-2fa-enterprise-server-cross-site-scripting