CVE-2019-12962

MEDIUMNuclei

LiveZilla Server 8.0.1.0 - 'Accept-Language' Reflected XSS

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2019-12962 has a selected CVSS score of 6.1 (medium); EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

LiveZilla Server before 8.0.1.1 is vulnerable to XSS in mobile/index.php via the Accept-Language HTTP header.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Nuclei templates
1

Proofs of concept

1

Catalogued exploits

ExploitDBLiveZilla Server 8.0.1.0 - 'Accept-Language' Reflected XSSExploitDB exploitby Clément CruchetNot analyzed1 file
ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMLiveZilla Server 8.0.1.0 - Cross-Site ScriptingCVSS 6.1

LiveZilla Server 8.0.1.0 is vulnerable to reflected cross-site scripting.

Impact

Attackers can inject malicious JavaScript through the Accept-Language header, potentially stealing session cookies, credentials, or performing unauthorized actions on behalf of victims.

Remediation

Upgrade to the latest version of LiveZilla Server or apply the vendor-provided patch to mitigate this vulnerability.

WeaknessesCWE-79
AuthorsClment Cruchet
Template tagscvecve2019xssedbpacketstormlivezillavuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:livezilla:livezilla:*:*:*:*:*:*:*:*
Shodan: http.html:LiveZilla
Shodan: http.html:livezilla
FOFA: body=livezilla
https://www.exploit-db.com/exploits/49669 https://forums.livezilla.net/index.php?/topic/10984-fg-vd-19-083085087-livezilla-server-are-vulnerable-to-cross-site-scripting-in-admin-panel/ http://packetstormsecurity.com/files/161867/LiveZilla-Server-8.0.1.0-Cross-Site-Scripting.html https://nvd.nist.gov/vuln/detail/CVE-2019-12962 https://github.com/anonymous364872/Rapier_Tool

Source: ProjectDiscovery

References

4