PT-2023-31947 · Unknown+1 · Thirty Bees+1

Ulaş Deniz İlhan · Publicado 2023-12-30 · Atualizado 2024-01-05 · CVE-2023-52264

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The beesblog (aka Bees Blog) component for thirty bees version 1.6.2 and earlier

Description The issue allows Reflected XSS because the sharing url in controllers/front/post.php is mishandled. This can lead to malicious scripts being injected into the website.

Recommendations For versions prior to 1.6.2, update to version 1.6.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the controllers/front/post.php file or disabling the sharing url parameter until a patch is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-52264

Produtos afetados

Beesblog

Thirty Bees

Referências · 10

• https://github.com/thirtybees/beesblog/compare/1.6.1...1.6.2 · Correção
• https://github.com/thirtybees/beesblog/commit/a3aeed8fcf01c8e4112c168cf2ef7d67c8056daf · Correção
• https://twitter.com/CVEnew/status/1741227543435579681 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1741273573480603742 · Publicação no Twitter
• https://zigrin.com/advisories/thirty-bees-reflected-cross-site-scripting-vulnerability · Nota
• https://t.me/cibsecurity/74046 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-52264 · Nota de Segurança
• https://t.me/cvenotify/66456 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-52264 · Aviso do Fabricante
• https://t.me/cvenotify/65822 · Publicação no Telegram