PT-2019-18453 · Croogo · Croogo

Segfaultmaster · Publicado 2019-01-29 · Atualizado 2022-05-14 · CVE-2019-7173

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Croogo versions prior to 3.0.7

Description A stored-self XSS issue allows an attacker to execute HTML or JavaScript code in a vulnerable Title field to the "/admin/file-manager/attachments/edit/4" API endpoint. This enables the attacker to inject malicious code, potentially leading to unauthorized actions or data exposure.

Recommendations For Croogo versions prior to 3.0.7, update to version 3.0.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/admin/file-manager/attachments/edit/4" endpoint or sanitizing user input in the Title field to prevent code injection.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-7173

GHSA-Q5FG-V5P7-R424

Produtos afetados

Croogo

Referências · 6

• 🔥 https://github.com/croogo/croogo/issues/889 · Exploit
• https://github.com/croogo/croogo/commit/cafaaabe2cef3d1d83652370e30563e6ad7c4158 · Nota
• https://github.com/croogo/croogo · Nota
• https://osv.dev/vulnerability/CVE-2019-7173 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-7173 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-q5fg-v5p7-r424 · Aviso do Fabricante