CVE-2018-19773

Vulnerability

Reflected Cross-Site Scripting (XSS) vulnerability in InfoVista VistaPortal SE Version 5.1 (build 51029). The issue exists in the EditCurrentUser.jsp page, where the GroupId and ConnPoolName parameters are not properly sanitized, allowing injection of arbitrary HTML and JavaScript. [1]

Exploitation

An attacker can craft a malicious URL containing XSS payload in the GroupId or ConnPoolName parameters. When a victim visits the crafted URL, the payload executes in the context of the vulnerable application. No authentication is required for exploitation. [1]

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information. The attack is limited to the scope of the vulnerable page and user's session.

Mitigation

As of the publication date (2018-12-17), no official patch has been released. Users should apply input validation and output encoding for the affected parameters, or restrict access to the EditCurrentUser.jsp page. [1]