CVE-2018-15528 Reflected Cross-Site Scripting exists in the Java System Solutions SSO plugin 4.0.13.1 for BMC MyIT. A remote attacker can abuse this issue to inject client-side scripts into the "select_sso()" functi...
MediumCVSS 6.1
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Reflected Cross-Site Scripting exists in the Java System Solutions SSO plugin 4.0.13.1 for BMC MyIT. A remote attacker can abuse this issue to inject client-side scripts into the "select_sso()" function. The payload is triggered when the victim opens a prepared /ux/jss-sso/arslogin?[XSS] link and then clicks the "Login" button.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| javasystemsolutions sso plugin | = 4.0.13.1 | No fix listed |
References
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 20180820 [CVE-2018-15528] Reflected XSS in Java System Solutions SSO Plugin 4.0.13.1 for BMC MyIT exploit mailing-list third-party-advisory