Giter VIP home page Giter VIP logo

yellowfin-multiple-vulnerabilities's Introduction

Yellowfin < 9.6.1 Multiple Vulnerabilities

Table of contents:

Vulnerability 1: Stored XSS

Vulnerability

Stored Cross-Site Scripting

Affected Products and Versions

Yellowfin < 9.6.1

CVEID:

CVE-2021-36387

CVSSv3.1 Score

5.4 (Medium)

CVSSv3.1 Attack Vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Short Description

In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploitable through a specially crafted HTTP POST request to the page "ActivityStreamAjax.i4".

Remediation

Update Yellowfin to the latest version available

Discoverer

Michele Di Bonaventura (cyberaz0r)

Reference

https://wiki.yellowfinbi.com/display/yfcurrent/Release+Notes+for+Yellowfin+9#ReleaseNotesforYellowfin9-Yellowfin9.6

Vulnerability 2: Profile pics IDOR

Vulnerability

Insecure Direct Object Reference

Affected Products and Versions

Yellowfin < 9.6.1

CVEID

CVE-2021-36388

CVSSv3.1 Score

7.5 (High)

CVSSv3.1 Attack Vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Short Description

In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIIAvatarImage.i4".

Remediation

Update Yellowfin to the latest version available

Discoverer

Michele Di Bonaventura (cyberaz0r)

Reference

https://wiki.yellowfinbi.com/display/yfcurrent/Release+Notes+for+Yellowfin+9#ReleaseNotesforYellowfin9-Yellowfin9.6

Vulnerability 3: Images IDOR

Vulnerability

Insecure Direct Object Reference

Affected Products and Versions

Yellowfin < 9.6.1

CVEID

CVE-2021-36389

CVSSv3.1 Score

7.5 (High)

CVSSv3.1 Attack Vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Short Description

In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIImage.i4".

Remediation

Update Yellowfin to the latest version available

Discoverer

Michele Di Bonaventura (cyberaz0r)

Reference

https://wiki.yellowfinbi.com/display/yfcurrent/Release+Notes+for+Yellowfin+9#ReleaseNotesforYellowfin9-Yellowfin9.6

yellowfin-multiple-vulnerabilities's People

Contributors

cyberaz0r avatar

Watchers

avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.