PT-2021-24169 · Opmantek · Opmantek Open-Audit Community

Published 2021-12-20 · Updated 2022-02-28 · CVE-2021-44916

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Opmantek Open-AudIT Community versions 4.2.0 through 4.2.0

Description: The issue allows malicious JavaScript code to be executed in the victim's browser if a bad value is passed to the routine via a URL. This is a Cross Site Scripting (XSS) issue.

Recommendations: For Opmantek Open-AudIT Community version 4.2.0, update to version 4.3.0 to resolve the issue. As a temporary workaround, consider restricting access to URLs that may pass bad values to the routine. Avoid using URLs that may execute malicious JavaScript code in the victim's browser until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-44916

Affected Products

Opmantek Open-Audit Community

References · 10

• 🔥 https://exploit-db.com/exploits/50651 · Exploit
• 🔥 http://packetstormsecurity.com/files/165502/Open-AudIT-Community-4.2.0-Cross-Site-Scripting.html · Exploit
• https://github.com/Opmantek/open-audit/commit/e37b64bbd0219f03cb71cc1cd5bb010166a2b846 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-44916 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44916 · Vendor Advisory
• https://community.opmantek.com/display/OA/Errata+-+4.2.0+and+earlier+Javascript+vulnerability · Vendor Advisory
• https://community.opmantek.com/display/OA/Release+Notes+for+Open-AudIT+v4.3.0 · Vendor Advisory
• https://t.me/cvenotify/24635 · Telegram Post
• https://t.me/cibsecurity/34270 · Telegram Post
• https://t.me/cvenotify/25191 · Telegram Post