PT-2023-30041 · Zentao · Zentao

Publicado 2023-10-31 · Atualizado 2023-11-09 · CVE-2023-46475

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ZenTao version 18.3

Description A Stored Cross-Site Scripting issue was discovered where a user can create a project and inject malicious JavaScript code in the project's name field.

Recommendations For ZenTao version 18.3, consider restricting the ability to create projects or limiting the input in the project name field to prevent the injection of malicious JavaScript code until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-46475

Produtos afetados

Zentao

Referências · 8

• 🔥 https://github.com/elementalSec/CVE-Disclosures/blob/main/ZentaoPMS/CVE-2023-46475/CVE-2023-46475%20-%20Cross-Site%20Scripting%20%28Stored%29.md · Exploit
• https://github.com/easysoft/zentaopms · Nota
• https://t.me/cibsecurity/73428 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1719509826139472161 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-46475 · Aviso do Fabricante
• https://t.me/cvenotify/60372 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-46475 · Nota de Segurança
• https://twitter.com/CVEnew/status/1720055344343499063 · Publicação no Twitter