PT-2023-11772 · Churchcrm · Churchcrm

Muffyhub · Publicado 2023-08-11 · Atualizado 2023-08-17 · CVE-2020-28849

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ChurchCRM version 4.2.1

Description The issue allows remote attackers to execute arbitrary code and gain sensitive information via a crafted payload in the Add New Deposit field in the View All Deposit module. This is a Cross Site Scripting (XSS) vulnerability.

Recommendations For ChurchCRM version 4.2.1, consider disabling the Add New Deposit field in the View All Deposit module as a temporary workaround until a patch is available. Restrict access to the View All Deposit module to minimize the risk of exploitation. Avoid using crafted payloads in the Add New Deposit field until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2020-28849

Produtos afetados

Churchcrm

Referências · 7

• 🔥 https://github.com/ChurchCRM/CRM/issues/5477 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-28849 · Nota de Segurança
• https://t.me/cvenotify/56705 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1690264250722258944 · Publicação no Twitter
• https://t.me/cvenotify/56263 · Publicação no Telegram
• https://t.me/cibsecurity/68354 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2020-28849 · Aviso do Fabricante