PT-2023-22632 · Payatu · Payatu Chatengine

Akshat Singhal · Publicado 2023-07-06 · Atualizado 2023-07-12 · CVE-2023-30322

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Payatu ChatEngine version 1.0

Description The issue is related to a Cross Site Scripting (XSS) vulnerability in the username field, located in the /src/chatbotapp/chatWindow.java file. This vulnerability allows attackers to execute arbitrary code.

Recommendations For Payatu ChatEngine version 1.0, consider disabling the username field in the chatWindow.java file as a temporary workaround until a patch is available. Restrict access to the chatWindow.java file to minimize the risk of exploitation. Avoid using the username field in the affected API endpoint until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-30322

Produtos afetados

Payatu Chatengine

Referências · 5

• https://github.com/wliang6/ChatEngine/blob/master/src/chatbotapp/chatWindow.java#L71:L81 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-30322 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-30322 · Aviso do Fabricante
• https://t.me/cibsecurity/66114 · Publicação no Telegram
• https://payatu.com/advisory/cross-site-scripting-xss-in-username-field-in-chatwindow-functionality-in-chatengine-1-0 · Nota