PT-2023-12407 · Shannah · Xataface

Shannah · Publicado 2023-01-05 · Atualizado 2024-05-17 · CVE-2021-4303

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions shannah Xataface versions up to 2.x

Description A problematic issue has been found in the function testftp of the file install/install form.js.php of the component Installer, leading to cross site scripting. The attack may be launched remotely, with a rather high complexity and difficult exploitation. Upgrading to version 3.0.0 can address this issue.

Recommendations For shannah Xataface versions up to 2.x, upgrade to version 3.0.0 to address the issue. As a temporary workaround, consider disabling the testftp function of the Installer component until the upgrade is applied. Note that the Installer is disabled by default.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2021-4303

GHSA-64WV-C7JW-JW2Q

Produtos afetados

Xataface

Referências · 9

• https://github.com/shannah/xataface/releases/tag/3.0.0 · Correção
• https://github.com/shannah/xataface/commit/94143a4299e386f33bf582139cd4702571d93bde · Correção
• https://github.com/shannah/xataface · Nota
• https://osv.dev/vulnerability/GHSA-64wv-c7jw-jw2q · Aviso do Fabricante
• https://vuldb.com/?id.217442 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2021-4303 · Nota de Segurança
• https://t.me/cvenotify/41818 · Publicação no Telegram
• https://vuldb.com/?ctiid.217442 · Nota
• https://osv.dev/vulnerability/CVE-2021-4303 · Aviso do Fabricante