PT-2023-13423 · Vermeg · Vermeg Agilereporter

Crashpark · Publicado 2023-10-27 · Atualizado 2023-11-08 · CVE-2022-34834

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions VERMEG AgileReporter version 21.3

Description An issue was discovered in VERMEG AgileReporter where attackers can gain privileges via an XSS payload in an Add Comment action to the Activity log.

Recommendations For VERMEG AgileReporter version 21.3, consider disabling the Add Comment action to the Activity log until a patch is available to prevent exploitation via XSS payload.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2022-34834

Produtos afetados

Vermeg Agilereporter

Referências · 7

• 🔥 https://crashpark.weebly.com/blog/2-stored-xss-in-agilereporter-213-by-vermeg · Exploit
• https://vermeg.com/agile-reporter · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-34834 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-34834 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1718013091609292995 · Publicação no Twitter
• https://t.me/cibsecurity/73090 · Publicação no Telegram
• https://twitter.com/DMFezzaReedCISA/status/1718029462057467987 · Publicação no Twitter