PT-2023-29740 · Gibbonedu · Gibbon

Christian Poeschl · Publicado 2023-11-13 · Atualizado 2023-11-17 · CVE-2023-45879

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GibbonEdu Gibbon version 25.0.0

Description The issue allows HTML Injection via an IFRAME element to the Messager component. This can potentially lead to malicious code execution.

Recommendations For GibbonEdu Gibbon version 25.0.0, consider disabling the Messager component until a patch is available to prevent HTML Injection via an IFRAME element.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-45879

Produtos afetados

Gibbon

Referências · 6

• 🔥 https://herolab.usd.de/security-advisories/usd-2023-0019 · Exploit
• https://t.me/cvenotify/60616 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-45879 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1724301076478755096 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-45879 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1724398749978411299 · Publicação no Twitter