Description
Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 contains a stored cross-site scripting vulnerability in the configuration file upload functionality. Attackers can upload a malicious HTML file to that executes arbitrary JavaScript in a user's browser session when viewed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Leica Geosystems | GR10/GR25/GR30/GR50 GNSS | 4.30.063, 4.20.232, 4.11.606, 3.22.1818, 3.10.1633, 2.62.782, 1.00.395 | — |
References
- ExploitDB-46091 exploit
- Leica Geosystems Official Product Homepage product
- Zero Science Lab Disclosure (ZSL-2019-5503) third-party-advisory