PT-2022-16806 · Dsk · Dsknet

Published 2022-07-18 · Updated 2022-07-27 · CVE-2022-24692

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DSK DSKNet versions 2.16.136.0 through 2.17.136.5

Description An issue was discovered in the new menu option within the general Parameters page, which is vulnerable to stored XSS. The attacker can create a menu option, make it visible to every application user, and conduct session hijacking, account takeover, or malicious code delivery, with the final goal of achieving client-side code execution.

Recommendations For versions 2.16.136.0 through 2.17.136.5, consider disabling the new menu option within the general Parameters page until a patch is available to prevent stored XSS attacks. Restrict access to the Parameters page to minimize the risk of exploitation. Avoid using the vulnerable menu option in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-24692

Affected Products

Dsknet

References · 6

• 🔥 https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2022-24688-92.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2022-24692 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24692 · Security Note
• https://t.me/cvenotify/33298 · Telegram Post
• https://dsk.lu/fr/produits/temps-de-presence · Note
• https://t.me/cibsecurity/46437 · Telegram Post