PT-2023-20918 · Unknown · Mirotalk P2P

L4Rm4Nd · Publicado 2023-03-22 · Atualizado 2023-03-28 · CVE-2023-27054

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MiroTalk P2P versions before commit f535b35

Description A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under the settings module. This enables attackers to potentially manipulate the application's behavior or steal user data.

Recommendations For versions before commit f535b35, consider restricting access to the settings module until a patch is available. As a temporary workaround, avoid using the Name parameter in the settings module to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-27054

Produtos afetados

Mirotalk P2P

Referências · 8

• 🔥 https://github.com/miroslavpejic85/mirotalk/issues/139 · Exploit
• https://github.com/miroslavpejic85/mirotalk/commit/f535b3515d2d480dc3135b37982f5df93e43c592 · Correção
• https://github.com/miroslavpejic85/mirotalk · Nota
• https://t.me/cvenotify/46687 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-27054 · Aviso do Fabricante
• https://t.me/cibsecurity/60536 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-27054 · Nota de Segurança
• https://t.me/cvenotify/46683 · Publicação no Telegram