PT-2022-16741 · Burden · Burden

Published 2022-02-15 · Updated 2022-02-23 · CVE-2022-24589

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Burden version 3.0

Description The issue is related to a stored cross-site scripting (XSS) in the Add Category function. This allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the task parameter.

Recommendations For Burden version 3.0, consider disabling the Add Category function until a patch is available to prevent exploitation of the stored XSS vulnerability. Restrict access to the task parameter to minimize the risk of arbitrary web script or HTML execution.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-24589

Affected Products

Burden

References · 7

• 🔥 https://github.com/Nguyen-Trung-Kien/CVE · Exploit
• 🔥 https://github.com/Nguyen-Trung-Kien/CVE/blob/main/CVE-2022-24589/CVE-2022-24589.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-24589 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24589 · Vendor Advisory
• https://t.me/cvenotify/26817 · Telegram Post
• https://t.me/cibsecurity/37534 · Telegram Post
• https://t.me/cvenotify/27232 · Telegram Post