XXE & SQLi in PaperThin CommonSpot CMS

Aon’s Cyber Solutions has discovered multiple vulnerabilities affecting CommonSpot CMS v10.6 and earlier. An unauthenticated XML External Entity Injection (XXE) vulnerability along with two authenticated SQL Injection vulnerabilities were discovered by Sean Melia. CVE IDs are pending assignment.

Aon would like to thank PaperThin for working with us as part of our coordinated disclosure process. Patches remediating the vulnerabilities were made available to CommonSpot users in November 2019.

Timeline:
10/28/19 – Initial disclosure to PaperThin
11/12/19 – Issues confirmed and patches developed
11/25/19 – Patches released
01/30/20 – Aon advisory released

First Name: *

Last Name: *

Business Email: *

Business Phone:

Job Title: *

Company: *

Location: *

How may we help you?

Aon and other Aon group companies will use your personal information to contact you from time to time about other products, services and events that we feel may be of interest to you. All personal information is collected and used in accordance with our privacy statement.

Please click here if you do not wish to receive these communications.

Cyber security services offered by Stroz Friedberg Inc. and its affiliates. Insurance products and services offered by Aon Risk Insurance Services West, Inc., Aon Risk Services Central, Inc., Aon Risk Services Northeast, Inc., Aon Risk Services Southwest, Inc., and Aon Risk Services, Inc. of Florida and their licensed affiliates. Aon UK Limited is authorised and regulated by the Financial Conduct Authority in respect of insurance distribution services. FP.AGRC.238.JJ The following products or services are not regulated by the Financial Conduct Authority:
• Cyber risk services provided by Aon UK Limited and its affiliates
• Cyber security services provided by Stroz Friedberg Limited and its affiliates.

Copyright 2021 Aon plc. All Rights Reserved.