PT-2022-15811 · Unknown · Petereport

Alestorm980 · Published 2022-03-03 · Updated 2022-03-10 · CVE-2022-23051

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PeteReport version 0.5

Description The issue allows an authenticated admin user to inject persistent JavaScript code while adding an 'Attack Tree' by modifying the svg file parameter. This enables the execution of malicious code, potentially leading to security breaches.

Recommendations For PeteReport version 0.5, consider disabling the ability to add 'Attack Tree' elements or restrict modifications to the svg file parameter until a patch is available. As a temporary workaround, limit access to admin users and monitor for any suspicious activity related to JavaScript code injection. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-23051

Affected Products

Petereport

References · 6

• 🔥 https://github.com/1modm/petereport/issues/36 · Exploit
• 🔥 https://fluidattacks.com/advisories/brown · Exploit
• https://osv.dev/vulnerability/CVE-2022-23051 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23051 · Security Note
• https://t.me/cvenotify/28026 · Telegram Post
• https://t.me/cibsecurity/38401 · Telegram Post