Reflected Cross-Site Scripting (XSS) vulnerability in ITIUM 6050
Posted date 21/03/2025
Identificador
INCIBE-2025-0152
Importance
3 - Medium
Affected Resources
ITIUM 6050, 5.5.5.2-b3526 version.
Description
INCIBE has coordinated the publication of a medium severity vulnerability affecting ITIUM 6050, a thin client, which has been discovered by Ismael Pacheco Torrecilla.
This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and vulnerability type CWE:
- CVE-2025-2597: CVSS v4.0: 5.1 | CVSS AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | CWE-79
Solution
There is no reported solution at this time.
Detail
CVE-2025-2597: reflected Cross-Site Scripting (XSS) in ITIUM 6050 version 5.5.5.2-b3526 from Impact Technologies. This vulnerability could allow an attacker to execute malicious Javascript code via GET and POST requests to the ‘/index.php’ endpoint and injecting code into the ‘id_session.
References list
Etiquetas
