Description (CNA)
Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 contains a stored cross-site scripting vulnerability in the configuration file upload functionality. Attackers can upload a malicious HTML file to that executes arbitrary JavaScript in a user's browser session when viewed.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Leica Geosystems AG / GR10/GR25/GR30/GR50 GNSS | affected 4.30.063; affected 4.20.232; affected 4.11.606; affected 3.22.1818; affected 3.10.1633; affected 2.62.782; affected 1.00.395 |
CWE
CWE-79
References
- https://www.exploit-db.com/exploits/46091
- https://www.leica-geosystems.com
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5503.php
ADP enrichment
No English description supplied.