top of page
Writer's pictureNolan B. Kennedy

CVE-2020-8496: Stored XSS in Kronos Web Time and Attendance (webTA) 4.1.x

Updated: Jan 31, 2020


Overview


This advisory addresses a Stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affecting versions 4.1.x - 5.0 via the "Application Banner" input field of the "/ApplicationBanner" page.

This issue was reported to Kronos in accordance with responsible disclosure guidelines. Kronos responded that patches would be distributed by January and to include in the announcement that the latest version of Kronos webTA is not affected by this vulnerability. See screenshot of vendor email response below:


Kronos Email Response
Kronos Email Response

Vulnerability Information



Definitions


CVE  Common Vulnerabilities and Exposures is a dictionary of common names (CVE Identifiers) for publicly known information security vulnerabilities maintained by the MITRE Corporation. 


CVSS  Common Vulnerability Scoring System is a vendor agnostic, industry open standard designed to convey the severity of a vulnerability. CVSS scores may be used to determine the urgency for update deployment within an organization and can range from 0.0 (no vulnerability) to 10.0 (critical). BlackBerry uses CVSSv3 in vulnerability assessments to present an immutable characterization of security vulnerabilities. BlackBerry assigns all relevant security vulnerabilities a non-zero score. Customers performing their own risk assessments of vulnerabilities that may impact them can benefit from using the same industry-recognized CVSS metrics. 


Mitigations    Mitigations are existing conditions that a potential attacker would need to overcome to mount a successful attack or that would limit the severity of an attack. Examples of such conditions include default settings, common configurations and general best practices. 


Workarounds  Workarounds are settings or configuration changes that a user or administrator can apply to help protect against an attack.  



Acknowledgements


This vulnerability was discovered and reported by Elwood Buck and Nolan B. Kennedy of MindPoint Group. (See email screenshot at top of page in Overview section).




Comments


bottom of page