PT-2023-32770 · Unknown · Amazing Little Poll

David Utón Amaya + 1 · Publicado 2023-12-13 · Atualizado 2023-12-22 · CVE-2023-6769

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Amazing Little Poll versions 1.3 through 1.4

Description The issue is a Stored XSS vulnerability that allows a remote attacker to store a malicious JavaScript payload in the "lp admin.php" file using the question and item parameters. This could lead to malicious JavaScript execution while the page is loading.

Recommendations For versions 1.3 and 1.4, consider disabling access to the "lp admin.php" file or restricting the use of the question and item parameters until a patch is available. As a temporary workaround, avoid using the question and item parameters in the affected API endpoint.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-6769

Produtos afetados

Amazing Little Poll

Referências · 7

• https://twitter.com/VulmonFeeds/status/1737436784651370616 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-6769 · Aviso do Fabricante
• https://t.me/cvenotify/64366 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1737416052907417688 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-6769 · Nota de Segurança
• https://twitter.com/David_Uton/status/1734985279310569888 · Publicação no Twitter
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amazing-little-poll · Nota