PT-2023-10253 · Openseamap · Openseamap Online Chart

Aaxee · Publicado 2023-02-07 · Atualizado 2024-05-17 · CVE-2015-10074

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenSeaMap online chart version 1.2

Description A vulnerability was found in the function init of the file index.php. The manipulation of the argument mtext leads to cross site scripting. It is possible to launch the attack remotely.

Recommendations For OpenSeaMap online chart version 1.2, upgrade to version staging to address this issue. As a temporary workaround, consider restricting access to the init function in the index.php file until the upgrade is applied. Additionally, avoid using the mtext argument in the affected component until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-10074

Produtos afetados

Openseamap Online Chart

Referências · 8

• https://github.com/OpenSeaMap/online_chart/releases/tag/staging · Correção
• https://github.com/OpenSeaMap/online_chart/commit/8649157158f921590d650e2d2f4bdf0df1017e9d · Correção
• https://github.com/OpenSeaMap/online_chart/pull/70 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2015-10074 · Nota de Segurança
• https://t.me/cvenotify/43759 · Publicação no Telegram
• https://t.me/cvenotify/59791 · Publicação no Telegram
• https://vuldb.com/?ctiid.220218 · Nota
• https://vuldb.com/?id.220218 · Nota