PT-2022-11744 · Unknown · Gnuboard Youngcart5

Published 2022-12-28 · Updated 2024-08-03 · CVE-2021-4293

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions gnuboard youngcart5 versions up to 5.4.5.1

Description A vulnerability has been found in gnuboard youngcart5, where the manipulation of the argument me link in the file adm/menu list update.php leads to cross site scripting. This issue can be exploited remotely. The affected products are no longer supported by the maintainer.

Recommendations For gnuboard youngcart5 versions up to 5.4.5.1, upgrade to version 5.4.5.2 to address this issue. As a temporary workaround, consider restricting access to the adm/menu list update.php file until the upgrade is applied. Avoid using the me link argument in the affected file to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-4293

Affected Products

Gnuboard Youngcart5

References · 8

• https://github.com/gnuboard/youngcart5/releases/tag/5.4.5.2 · Patch
• https://github.com/gnuboard/youngcart5/commit/70daa537adfa47b87af12d85f1e698fff01785ff · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-4293 · Security Note
• https://osv.dev/vulnerability/CVE-2021-4293 · Vendor Advisory
• https://vuldb.com/?ctiid.216954 · Note
• https://t.me/cibsecurity/55465 · Telegram Post
• https://t.me/cvenotify/88821 · Telegram Post
• https://vuldb.com/?id.216954 · Note