CVE-2019-7671

Prima Systems FlexAir, Versions 2.3.38 and prior. Parameters sent to scripts are not properly sanitized before being returned to the user, which may allow an attacker to execute arbitrary code in a users browser session in context of an affected site.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9 CRITICAL
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 92%
VendorProductVersion
primasystemsflexair
𝑥
≤ 2.3.38
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/155274/Prima-Access-Control-2.3.35-Cross-Site-Scripting.html
https://applied-risk.com/index.php/download_file/view/199/165
https://applied-risk.com/labs/advisories
https://applied-risk.com/resources/ar-2019-007
https://www.us-cert.gov/ics/advisories/icsa-19-211-02
http://packetstormsecurity.com/files/155274/Prima-Access-Control-2.3.35-Cross-Site-Scripting.html
https://applied-risk.com/index.php/download_file/view/199/165
https://applied-risk.com/labs/advisories
https://applied-risk.com/resources/ar-2019-007
https://www.us-cert.gov/ics/advisories/icsa-19-211-02