CVE-2017-12460

An issue was discovered in Barco ClickShare CSM-1 firmware before v1.7.0.3 and CSC-1 firmware before v1.10.0.10. An authenticated user can manage the wallpaper collection in the webUI to be shown as background on the ClickShare product. By uploading a wallpaper with a specially crafted name, an HTML injection can be triggered as special characters are not neutralized before output.
References
Link Resource
https://www.barco.com/en/Support/software/R33050037 Issue Tracking Vendor Advisory
https://www.barco.com/en/support/knowledge-base/KB5169 Issue Tracking Vendor Advisory
https://www.barco.com/en/support/software/R33050020 Issue Tracking Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:barco:clickshare_csm-1_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:barco:clickshare_csm-1:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:barco:clickshare_csc-1_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:barco:clickshare_csc-1:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-10-30 14:29

Updated : 2024-02-04 19:29


NVD link : CVE-2017-12460

Mitre link : CVE-2017-12460

CVE.ORG link : CVE-2017-12460


JSON object : View

Products Affected

barco

  • clickshare_csm-1_firmware
  • clickshare_csm-1
  • clickshare_csc-1
  • clickshare_csc-1_firmware
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')