PT-2023-27142 · Mingsoft · Mingsoft Mcms

一剑还原 · Publicado 2023-07-28 · Atualizado 2024-05-17 · CVE-2023-3990

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mingsoft MCMS versions up to 5.3.1

Description A problematic vulnerability has been found in Mingsoft MCMS, affecting an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross-site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations For Mingsoft MCMS versions up to 5.3.1, apply a patch to fix this issue. As a temporary workaround, consider restricting access to the search.do file or disabling the manipulation of the style argument in the HTTP POST Request Handler to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-3990

GHSA-RXVJ-5MV6-J5MC

Produtos afetados

Mingsoft Mcms

Referências · 8

• 🔥 https://gitee.com/mingSoft/MCMS/issues/I7K4DQ · Exploit
• https://github.com/ming-soft/MCMS · Nota
• https://vuldb.com/?id.235611 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-3990 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-rxvj-5mv6-j5mc · Aviso do Fabricante
• https://t.me/cibsecurity/67359 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-3990 · Aviso do Fabricante
• https://vuldb.com/?ctiid.235611 · Nota