PT-2019-18453 · Croogo · Croogo

Segfaultmaster · Published 2019-01-29 · Updated 2022-05-14 · CVE-2019-7173

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Croogo versions prior to 3.0.7

Description A stored-self XSS issue allows an attacker to execute HTML or JavaScript code in a vulnerable Title field to the "/admin/file-manager/attachments/edit/4" API endpoint. This enables the attacker to inject malicious code, potentially leading to unauthorized actions or data exposure.

Recommendations For Croogo versions prior to 3.0.7, update to version 3.0.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/admin/file-manager/attachments/edit/4" endpoint or sanitizing user input in the Title field to prevent code injection.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-7173

GHSA-Q5FG-V5P7-R424

Affected Products

Croogo

References · 6

• 🔥 https://github.com/croogo/croogo/issues/889 · Exploit
• https://osv.dev/vulnerability/CVE-2019-7173 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7173 · Security Note
• https://osv.dev/vulnerability/GHSA-q5fg-v5p7-r424 · Vendor Advisory
• https://github.com/croogo/croogo/commit/cafaaabe2cef3d1d83652370e30563e6ad7c4158 · Note
• https://github.com/croogo/croogo · Note