CVE-2019-15501

MEDIUMNuclei

LSoft ListServ < 16.5-2018a - Cross-Site Scripting

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2019-15501 has a selected CVSS score of 6.1 (medium); EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

Reflected cross site scripting (XSS) in L-Soft LISTSERV before 16.5-2018a exists via the /scripts/wa.exe OK parameter.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Nuclei templates
1

Proofs of concept

1

Catalogued exploits

ExploitDBLSoft ListServ < 16.5-2018a - Cross-Site ScriptingExploitDB exploitby MTKNot analyzed1 file
ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUML-Soft LISTSERV <16.5-2018a - Cross-Site ScriptingCVSS 6.1

L-Soft LISTSERV before 16.5-2018a contains a reflected cross-site scripting vulnerability via the /scripts/wa.exe OK parameter.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential data theft or unauthorized actions.

Remediation

Upgrade to a version of L-Soft LISTSERV that is higher than 16.5-2018a to mitigate the XSS vulnerability.

WeaknessesCWE-79
AuthorsLogicalHunter, arafatansari
Template tagscve2019cvexsslistservedblsoftvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:lsoft:listserv:*:*:*:*:*:*:*:*
Shodan: http.html:"LISTSERV"
Shodan: http.html:"listserv"
FOFA: body="listserv"
https://www.exploit-db.com/exploits/47302 http://www.lsoft.com/manuals/16.5/LISTSERV16.5-2018a_WhatsNew.pdf https://nvd.nist.gov/vuln/detail/CVE-2019-15501 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

3