CVE-2020-16270: OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject malicious JavaScript payload to victim’s browsers in context of vulnerable appli...

Summary

OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject malicious JavaScript payload to victim’s browsers in context of vulnerable applications. Executed code can be used to steal administrator’s cookies, influence HTML content of targeted...

What to do

Update olimpoks olimpok to version 3.3.39 or later.

Affected software

Vendor	Product	Affected versions
olimpoks	olimpok	< 3.3.39 `cpe:2.3:a:olimpoks:olimpok::::::::`

Original advisory text

OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject malicious JavaScript payload to victim’s browsers in context of vulnerable appli...

OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject malicious JavaScript payload to victim’s browsers in context of vulnerable applications. Executed code can be used to steal administrator’s cookies, influence HTML content of targeted application and perform phishing-related attacks. Vulnerable application used in more than 3000 organizations in different sectors from retail to industries.

References

https://bdu.fstec.ru/vul/2020-04623 Third Party Advisory
https://github.com/Security-AVS/CVE-2020-16270 Third Party Advisory
https://olimpoks.ru/oks/forum/olimpoks5.php Product Vendor Advisory