Description (CNA)
An issue was discovered in Nokia NetAct 22 through the Site Configuration Tool website section. A malicious user can change a filename of an uploaded file to include JavaScript code, which is then stored and executed by a victim's web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. Here, the /netact/sct filename parameter is used.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.html
- https://www.gruppotim.it/it/footer/red-team.html
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.