« Volver al listado

CVE-2019-17551

Estado: ModificadaMedia (6.1)—

In Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.5, an attacker can send an authenticated POST request with a malicious payload to /WFS/agreementView.faces allowing a stored XSS via the mainForm:loanNotesnotes:0:rich_text_editor_note_text parameter in the Notes section. Although versions 6.31.8.3 and 6.31.8.5 are confirmed to be affected, all versions with the vulnerable WYSIWYG editor in the Notes section are likely affected.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apakgroup — Wholesale Floorplanning Finance

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-17551",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-10-31T03:15:11.777",
  "references": [
    {
      "url": "https://www.apakgroup.com/products/wholesale-floorplanning-finance/",
      "tags": [
        "Product"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www2.deloitte.com/de/de/pages/risk/articles/wholesale-finance-xss.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.cybersecurity-help.cz/vdb/SB2019103106?affChecked=1",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "nvd@nist.gov"
    },
    {
      "url": "https://www.apakgroup.com/products/wholesale-floorplanning-finance/",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www2.deloitte.com/de/de/pages/risk/articles/wholesale-finance-xss.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.5, an attacker can send an authenticated POST request with a malicious payload to /WFS/agreementView.faces allowing a stored XSS via the mainForm:loanNotesnotes:0:rich_text_editor_note_text parameter in the Notes section. Although versions 6.31.8.3 and 6.31.8.5 are confirmed to be affected, all versions with the vulnerable WYSIWYG editor in the Notes section are likely affected."
    },
    {
      "lang": "es",
      "value": "En Apak Wholesale Floorplanning Finance versiones 6.31.8.3 y 6.31.8.5, un atacante puede enviar una petición POST autenticada con una carga útil maliciosa a /WFS/agreementView.faces que permite un XSS almacenado a mediante el parámetro mainForm:loanNotesnotes:0:rich_text_editor_note_text en la sección de Notes. Si bien se confirma que las versiones 6.31.8.3 y 6.31.8.5 están afectadas, todas las versiones con la sección \"Notes\" de WYSIWYG vulnerable probablemente están afectadas."
    }
  ],
  "lastModified": "2026-06-17T02:24:08.123",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apakgroup:wholesale_floorplanning_finance:6.31.8.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F071E13C-50B8-46CD-9526-DD85C5941C7D"
            },
            {
              "criteria": "cpe:2.3:a:apakgroup:wholesale_floorplanning_finance:6.31.8.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1423503C-62EA-4989-9876-75674B98B871"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}