CVE-2019-16330: XSS

Published Oct 17, 2019

Updated

In NCH Express Accounts Accounting v7.02, persistent cross site scripting (XSS) exists in Invoices/Sales Orders/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Sales Orders/Items/Customers/Quotes fields parameter to inject arbitrary JavaScript.

Affected Software

1 affected component

Nchsoftware Express Accounts Accounting=7.02

Event History

Oct 17, 2019

CVE Published

via MITRE·04:55 PM

Data Sourced

via MITRE·04:55 PM

Description

Frequently Asked Questions

What is the vulnerability ID of this NCH Express Accounts Accounting vulnerability?

The vulnerability ID is CVE-2019-16330.

What is the title of the NCH Express Accounts Accounting vulnerability?

The title of the vulnerability is 'In NCH Express Accounts Accounting v7.02 persistent cross site scripting (XSS) exists in Invoices/Sales Orders/Items/Customers/Quotes input field.'

What is the description of the NCH Express Accounts Accounting vulnerability?

The description of the vulnerability is 'In NCH Express Accounts Accounting v7.02, persistent cross site scripting (XSS) exists in Invoices/Sales Orders/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Sales Orders/Items/Customers/Quotes fields parameter to inject arbitrary JavaScript.'

What is the severity of the NCH Express Accounts Accounting vulnerability?

The severity of the vulnerability is medium with a CVSS score of 5.4 (out of 10).

How can I fix the NCH Express Accounts Accounting vulnerability?

To fix the vulnerability, update NCH Express Accounts Accounting to version 7.03 or later.