PT-2023-31712 · Unknown · Englesystem

Skruppy · Publicado 2023-12-22 · Atualizado 2024-01-05 · CVE-2023-50924

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Englesystem versions prior to 3.4.1

Description Englesystem is a shift planning system for chaos events. The system performed insufficient validation of user-supplied data for the DECT number, mobile number, and work-log comment fields. This allowed the injection and execution of Javascript code in another user's context, enabling an authenticated user to inject Javascript into other users' sessions. The injected JS will be executed during normal usage of the system when viewing overview pages.

Recommendations For versions prior to 3.4.1, update to version 3.4.1 to resolve the issue. As a temporary workaround, consider restricting access to the log overview pages to minimize the risk of exploitation. Additionally, avoid using the DECT number, mobile number, and work-log comment fields until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-50924

GHSA-P5CH-RRPM-WVHM

Produtos afetados

Englesystem

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50924.json · Exploit
• https://github.com/engelsystem/engelsystem/security/advisories/GHSA-p5ch-rrpm-wvhm · Correção
• https://github.com/engelsystem/engelsystem/commit/efda1ffc1ce59f02a7d237d9087adea26e73ec5f · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-50924 · Nota de Segurança
• https://twitter.com/CVEnew/status/1738301544779727353 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-50924 · Aviso do Fabricante
• https://t.me/cvenotify/66356 · Publicação no Telegram
• https://twitter.com/cracbot/status/1738624149638033773 · Publicação no Twitter