PT-2023-23323 · Evasys · Evasys

Bsc + 3 · Publicado 2023-05-02 · Atualizado 2023-05-10 · CVE-2023-31434

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions evasys versions prior to 8.2 Build 2286 evasys versions 9.x prior to 9.0 Build 2401

Description The issue concerns the lack of input validation for certain parameters in evasys, specifically nutzer titel, nutzer vn, nutzer nn, langID, and ONLINEID. This allows authenticated attackers to inject HTML code and XSS payloads in multiple locations.

Recommendations For evasys versions prior to 8.2 Build 2286, update to version 8.2 Build 2286 or later. For evasys versions 9.x prior to 9.0 Build 2401, update to version 9.0 Build 2401 or later. As a temporary workaround, consider restricting access to the user profile and direct links to minimize the risk of exploitation. Avoid using the parameters nutzer titel, nutzer vn, nutzer nn, langID, and ONLINEID in the affected locations until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-31434

Produtos afetados

Evasys

Referências · 5

• 🔥 https://cves.at/posts/cve-2023-31434/writeup · Exploit
• https://osv.dev/vulnerability/CVE-2023-31434 · Aviso do Fabricante
• https://t.me/cvenotify/50116 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-31434 · Nota de Segurança
• https://t.me/cibsecurity/63175 · Publicação no Telegram