Webordersystem Kundenmanager
Monthly
Reflected cross-site scripting in the VertiGIS WebOrderSystem CustomerAdministration (KundenManager) portal allows an unauthenticated attacker to run JavaScript in a privileged user's browser by delivering a crafted URL whose searchValue parameter contains script code. The victim must be logged into the portal and open the link; because such users can change other accounts' passwords, including administrators', without the old password, successful exploitation can lead to account takeover or lockout. Version 7.0.8.6 is confirmed affected (the latest at time of testing) and the vendor has not stated which other versions are affected; no public exploit was identified at time of analysis and the priority is this_month (medium, CVSS 4.0 5.1).
Stored cross-site scripting in the CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem lets an authenticated, highly privileged portal user plant JavaScript inside editable employee properties such as 'secondName', which is then persisted and executed in the browser of any other privileged user who opens the edited entry or the corresponding user-group overview, running in that victim's authenticated portal session. Version 7.0.8.6, the latest available at the time of testing, is confirmed affected, and the vendor has not provided information on other versions. Severity is modest (CVSS 4.0 base score 4.8; the independently assessed CVSS 3.1 vector requires high privileges and user interaction), no public exploit code and no CISA KEV entry were identified at time of analysis, and exposure is further limited because both the injecting and the receiving accounts must hold employee-management rights in the portal.
Reflected cross-site scripting in the VertiGIS WebOrderSystem CustomerAdministration (KundenManager) portal allows an unauthenticated attacker to run JavaScript in a privileged user's browser by delivering a crafted URL whose searchValue parameter contains script code. The victim must be logged into the portal and open the link; because such users can change other accounts' passwords, including administrators', without the old password, successful exploitation can lead to account takeover or lockout. Version 7.0.8.6 is confirmed affected (the latest at time of testing) and the vendor has not stated which other versions are affected; no public exploit was identified at time of analysis and the priority is this_month (medium, CVSS 4.0 5.1).
Stored cross-site scripting in the CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem lets an authenticated, highly privileged portal user plant JavaScript inside editable employee properties such as 'secondName', which is then persisted and executed in the browser of any other privileged user who opens the edited entry or the corresponding user-group overview, running in that victim's authenticated portal session. Version 7.0.8.6, the latest available at the time of testing, is confirmed affected, and the vendor has not provided information on other versions. Severity is modest (CVSS 4.0 base score 4.8; the independently assessed CVSS 3.1 vector requires high privileges and user interaction), no public exploit code and no CISA KEV entry were identified at time of analysis, and exposure is further limited because both the injecting and the receiving accounts must hold employee-management rights in the portal.