CVE-2015-3443 Cross-site scripting (XSS) vulnerability in the basic dashboard in Thycotic Secret Server 8.6.x, 8.7.x, and 8.8.x before 8.8.000005 allows remote authenticated users to inject arbitrary web script or....
LowCVSS 3.5
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the basic dashboard in Thycotic Secret Server 8.6.x, 8.7.x, and 8.8.x before 8.8.000005 allows remote authenticated users to inject arbitrary web script or HTML via a password entry, which is not properly handled when toggling the password mask.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| thycotic secret server | = 8.6.000000 | No fix listed |
| thycotic secret server | = 8.6.000009 | No fix listed |
| thycotic secret server | = 8.6.000010 | No fix listed |
| thycotic secret server | = 8.7.000000 | No fix listed |
| thycotic secret server | = 8.8.000000 | No fix listed |
| thycotic secret server | = 8.8.000001 | No fix listed |
| thycotic secret server | = 8.8.000004 | No fix listed |
References
- 20150624 CVE-2015-3443 XSS in Thycotic Secret Server version 8.6.000000 to 8.8.000004 mailing-list
- thycotic.com vendor-advisory
- www.csnc.ch exploit vendor-advisory
- 20150624 CVE-2015-3443 XSS in Thycotic Secret Server version 8.6.000000 to 8.8.000004 mailing-list
- 75393 vdb-entry
- 37394 exploit