CVE-2019-17551
In Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.5, an attacker can send an authenticated POST request with a malicious payload to /WFS/agreementView.faces allowing a stored XSS via the mainForm:loanNotesnotes:0:rich_text_editor_note_text parameter in the Notes section. Although versions 6.31.8.3 and 6.31.8.5 are confirmed to be affected, all versions with the vulnerable WYSIWYG editor in the Notes section are likely affected.
- Score
- CVSS 3.1 6.1 Medium
- Status
- Modified - cve@mitre.org
- Published
- 2019-10-31
- Last modified
- 2024-08-05
- Weaknesses
- CWE-79
Affected products
References
- https://www.apakgroup.com/products/wholesale-floorplanning-finance/
- https://www2.deloitte.com/de/de/pages/risk/articles/wholesale-finance-xss.html
- https://www.cybersecurity-help.cz/vdb/SB2019103106?affChecked=1
