Cross-site Scripting Vulnerability in Stroom Application by Open Source
CVE-2019-10779

6.1MEDIUM

Key Information:

Vendor

Gchq

Status
Stroom:stroom-app
Vendor
CVE Published:
28 January 2020

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2019-10779?

The Stroom application is vulnerable to Cross-site Scripting, which allows malicious websites to load the Stroom UI within a concealed iframe. This security flaw can be exploited to issue commands from the attacker's site, enabling full control of the Stroom UI under the context of an authenticated user. Such a vulnerability emphasizes the need for prompt updates and rigorous security measures to safeguard sensitive user sessions from being hijacked.

Affected Version(s)

stroom:stroom-app all versions before 5.5.12

stroom:stroom-app all versions of the 6.0.0 branch before 6.0.25

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2019-10779
Created by RepublicR0K

References

https://snyk.io/vuln/SNYK-JAVA-STROOM-541182
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.