XSS in Thycotic Secret Server
CVE-2015-3443
Cross-site scripting (XSS) vulnerability in the basic dashboard in Thycotic Secret Server 8.6.x, 8.7.x, and 8.8.x before 8.8.000005 allows remote authenticated users to inject arbitrary web script or HTML via a password entry, which is not properly handled when toggling the password mask.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.020 (78.9th percentile) — read the EPSS interpretation.
Affected products
- Thycotic Secret_server — versions 8.6.000000, 8.6.000009, 8.6.000010
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (vdb-entry, x_refsource_BID)
- cve@mitre.org (mailing-list, x_refsource_FULLDISC)
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
- cve@mitre.org (Exploit, x_refsource_MISC, Vendor Advisory)
- cve@mitre.org (exploit, x_refsource_EXPLOIT-DB)