In Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.5, an attacker can send an authenticated POST request with a malicious payload to /WFS/agreementView.faces allowing a stored XSS via the mainForm:loanNotesnotes:0:rich_text_editor_note_text parameter in the Notes section. Although versions 6.31.8.3 and 6.31.8.5 are confirmed to be affected, all versions with the vulnerable WYSIWYG editor in the Notes section are likely affected.
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2019-10-31T02:55:26
Updated: 2019-11-07T19:02:45
Reserved: 2019-10-14T00:00:00
Link: CVE-2019-17551
JSON object: View
NVD Information
Status : Modified
Published: 2019-10-31T03:15:11.777
Modified: 2019-11-07T20:15:10.903
Link: CVE-2019-17551
JSON object: View
Redhat Information
No data.
CWE