search menu icon-carat-right cmu-wordmark
Carnegie Mellon University

Software Engineering Institute

CERT Coordination Center

TestRail cross-site scripting vulnerability

Vulnerability Note VU#669804

Original Release Date: 2014-07-24 | Last Revised: 2014-07-24

Overview

TestRail version 3.1.1.3130 contains a cross-site scripting vulnerability.

Description

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Gurock Software TestRail version 3.1.1.3130 contains a stored cross-site scripting vulnerability. The Created By field in project activities is vulnerable to script injection.

Impact

A remote attacker may be able to execute arbitrary script in the context of the end-user's browser session.

Solution

Apply a Patch
Gurock Software has released an update (Testrail 3.1.3) addressing this vulnerability.

Vendor Information

669804
 
Expand all

Gurock Software GmbH Affected

Notified:  July 18, 2014 Updated: July 24, 2014

Status

Affected

Vendor Statement

All TestRail Hosted accounts (the cloud/SaaS edition of TestRail) have already been updated automatically by the vendor. All TestRail on-premise customers can download the new version from the customer portal and follow the upgrade instructions as usual.

The vulnerability can only be taken advantage of by actual users with existing TestRail access. Persons without access to TestRail cannot inject any code using this vulnerability or access any information or data without permissions.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.


CVSS Metrics

Group Score Vector
Base 5 AV:N/AC:L/Au:N/C:N/I:P/A:N
Temporal 4.1 E:F/RL:OF/RC:C
Environmental 0 CDP:N/TD:N/CR:ND/IR:ND/AR:ND

References

Acknowledgements

Thanks to the reporter who wishes to remain anonymous.

This document was written by Chris King.

Other Information

CVE IDs: CVE-2014-4857
Date Public: 2014-07-24
Date First Published: 2014-07-24
Date Last Updated: 2014-07-24 17:04 UTC
Document Revision: 12

Sponsored by CISA.

Download PGP Key

Read CERT/CC Blog

Learn about Vulnerability Analysis