CVE-2017-12460

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2017-12460
An issue was discovered in Barco ClickShare CSM-1 firmware before v1.7.0.3 and CSC-1 firmware before v1.10.0.10. An authenticated user can manage the wallpaper collection in the webUI to be shown as background on the ClickShare product. By uploading a wallpaper with a specially crafted name, an HTML injection can be triggered as special characters are not neutralized before output.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector : AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

3.5 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://www.barco.com/en/Support/software/R33050037 Issue Tracking Vendor Advisory
https://www.barco.com/en/support/knowledge-base/KB5169 Issue Tracking Vendor Advisory
https://www.barco.com/en/support/software/R33050020 Issue Tracking Vendor Advisory
https://www.barco.com/en/Support/software/R33050037 Issue Tracking Vendor Advisory
https://www.barco.com/en/support/knowledge-base/KB5169 Issue Tracking Vendor Advisory
https://www.barco.com/en/support/software/R33050020 Issue Tracking Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:barco:clickshare_csm-1_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:barco:clickshare_csm-1:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:barco:clickshare_csc-1_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:barco:clickshare_csc-1:-:*:*:*:*:*:*:*
History

21 Nov 2024, 03:09

Type Values Removed Values Added
References () https://www.barco.com/en/Support/software/R33050037 - Issue Tracking, Vendor Advisory () https://www.barco.com/en/Support/software/R33050037 - Issue Tracking, Vendor Advisory
References () https://www.barco.com/en/support/knowledge-base/KB5169 - Issue Tracking, Vendor Advisory () https://www.barco.com/en/support/knowledge-base/KB5169 - Issue Tracking, Vendor Advisory
References () https://www.barco.com/en/support/software/R33050020 - Issue Tracking, Vendor Advisory () https://www.barco.com/en/support/software/R33050020 - Issue Tracking, Vendor Advisory
Information

Published : 2017-10-30 14:29

Updated : 2024-11-21 03:09

NVD link : CVE-2017-12460

Mitre link : CVE-2017-12460

CVE.ORG link : CVE-2017-12460

JSON object : View

Products Affected

barco

  • clickshare_csm-1_firmware
  • clickshare_csc-1
  • clickshare_csm-1
  • clickshare_csc-1_firmware
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')