PT-2023-31568 · Monica · Monica

Ev3Rr3D · Publicado 2023-12-10 · Atualizado 2023-12-13 · CVE-2023-50465

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Monica (aka MonicaHQ) version 4.0.0

Description A stored cross-site scripting (XSS) vulnerability exists in the software via an SVG document uploaded by an authenticated user.

Recommendations For version 4.0.0, consider restricting the upload of SVG documents by authenticated users until a patch is available. As a temporary workaround, disabling the feature to upload SVG files can help minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-50465

Produtos afetados

Monica

Referências · 9

• 🔥 https://github.com/Crypt0Cr33py/monicahqvuln · Exploit
• https://github.com/monicahq/monica/releases · Correção
• https://t.me/cvenotify/63128 · Publicação no Telegram
• https://monicahq.com · Nota
• https://osv.dev/vulnerability/CVE-2023-50465 · Aviso do Fabricante
• https://t.me/cvenotify/63558 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1734101364492382629 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1734016863862927453 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-50465 · Nota de Segurança