CVE-2019-16282: XSS

Published Oct 14, 2019

Updated

In NCH Express Invoice v7.12, persistent cross site scripting (XSS) exists via the Invoices/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Items/Customers fields parameter to inject arbitrary JavaScript.

Affected Software

1 affected component

Nchsoftware Express Invoice=7.12

Event History

Oct 14, 2019

CVE Published

via MITRE·05:02 PM

Data Sourced

via MITRE·05:02 PM

Description

Frequently Asked Questions

What is CVE-2019-16282?

CVE-2019-16282 is a vulnerability in NCH Express Invoice v7.12 that allows for persistent cross-site scripting (XSS) attacks.

How does the vulnerability in NCH Express Invoice v7.12 occur?

The vulnerability occurs when an authenticated unprivileged user adds or modifies the Invoices/Items/Customers fields parameter to inject arbitrary JavaScript.

What is the severity of CVE-2019-16282?

CVE-2019-16282 has a severity rating of medium with a CVSS score of 5.4.

How can an attacker exploit CVE-2019-16282?

An attacker can exploit CVE-2019-16282 by injecting malicious JavaScript through the Invoices/Items/Customers/Quotes input field.

Is there a fix available for CVE-2019-16282?

At the moment, there is no specific fix available for CVE-2019-16282, but it is recommended to update to the latest version of NCH Express Invoice and apply any patches or security updates provided by the vendor.