Samsung X7400GX Syncthru V6.A6.25 V11.01.05.25_08-21-2015 Web Service loginView.sws contextpath/basedURL cross site scripting

Summaryinfo

A vulnerability was found in Samsung X7400GX Syncthru V6.A6.25 V11.01.05.25_08-21-2015. It has been classified as problematic. This impacts an unknown function of the file /sws.login/gnb/loginView.sws of the component Web Service. The manipulation of the argument contextpath/basedURL as part of Parameter leads to cross site scripting. This vulnerability is listed as CVE-2019-7421. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in Samsung X7400GX Syncthru V6.A6.25 V11.01.05.25_08-21-2015 and classified as problematic. This issue affects an unknown code block of the file /sws.login/gnb/loginView.sws of the component Web Service. The manipulation of the argument contextpath/basedURL as part of a Parameter leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. The summary by CVE is:

XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws.login/gnb/loginView.sws" in multiple parameters: contextpath and basedURL.

The bug was discovered 02/06/2019. The weakness was presented 03/21/2019 as not defined mailinglist post (Full-Disclosure). The advisory is shared at seclists.org. The identification of this vulnerability is CVE-2019-7421 since 02/05/2019. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 43 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-132050, VDB-132051 and VDB-132052 for similar entries. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Samsung

Name

• X7400GX Syncthru

Version

• V6.A6.25 V11.01.05.25_08-21-2015

License

• commercial

Website

• Vendor: https://www.samsung.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion