Vulnerability Note VU#360431
Chiyu Technology fingerprint access control contains multiple vulnerabilities
Multiple models of Chiyu Technology fingerprint access control devices contain a cross-site scripting (XSS) vulnerability and an authentication bypass vulnerability.
CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) - CVE-2015-2870
According to the reporter, <script> tags are not filtered out of a URL passed to the device, allowing an attacker to perform a reflected XSS attack.
An unauthenticated remote attacker may be able to view or modify device configuration, or obtain user credentials.
The CERT/CC is currently unaware of a practical solution to this problem.
Vendor Information (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Chiyu Technologies||Affected||03 Jun 2015||07 Jul 2015|
CVSS Metrics (Learn More)
Thanks to Maxim Rupp for reporting this vulnerability to us.
This document was written by Garret Wassermann.
- CVE IDs: CVE-2015-2870 CVE-2015-2871
- Date Public: 31 Jul 2015
- Date First Published: 31 Jul 2015
- Date Last Updated: 31 Jul 2015
- Document Revision: 28
If you have feedback, comments, or additional information about this vulnerability, please send us email.