PT-2025-5610 · Rengine · Rengine

Theanm0L · Publicado 2025-02-04 · Atualizado 2025-05-13 · CVE-2025-24967

Positive Technologies (AI Summary)

CVSS v4.0

7.4

Alta

Vetor base

AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: reNgine versions prior to 2.20

Description: A stored cross-site scripting (XSS) issue exists in the admin panel's user management functionality, allowing an attacker to inject malicious payloads into the username field during user creation. This enables unauthorized script execution when the admin views or interacts with the affected user entry, posing a significant risk to sensitive admin functionalities.

Recommendations: For versions prior to 2.20, users are advised to monitor the project for future releases that address this issue. As a temporary workaround, consider restricting access to the user management functionality in the admin panel until a patch is available. Avoid using the username field in the affected user management functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-24967

GHSA-23WX-5Q5W-334W

Produtos afetados

Rengine

Referências · 8

• 🔥 https://github.com/yogeshojha/rengine/security/advisories/GHSA-23wx-5q5w-334w · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24967.json · Exploit
• https://twitter.com/CVEnew/status/1886861322442227786 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-24967 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1887022523151188457 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-24967 · Aviso do Fabricante
• https://t.me/cvedetector/17228 · Publicação no Telegram
• https://t.me/cvenotify/122027 · Publicação no Telegram