PT-2022-8713 · Unknown · 6Kare Emakin

Mhmtayberk · Published 2022-09-16 · Updated 2022-09-21 · CVE-2020-25491

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions 6Kare Emakin version 5.0.341.0

Description The issue is related to Cross Site Scripting (XSS) via the "/rpc/membership/setProfile" endpoint, specifically the DisplayName field, which is mishandled when rendering the Activity Stream page.

Recommendations For version 5.0.341.0, consider disabling the rendering of the DisplayName field in the Activity Stream page until a patch is available. Restrict access to the "/rpc/membership/setProfile" endpoint to minimize the risk of exploitation. Avoid using the DisplayName field in this endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-25491

Affected Products

6Kare Emakin

References · 5

• 🔥 https://gist.github.com/mhmtayberk/969add4b6c77f122a3a3a0cb00e2975b · Exploit
• https://osv.dev/vulnerability/CVE-2020-25491 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25491 · Security Note
• https://t.me/cvenotify/36604 · Telegram Post
• https://t.me/cibsecurity/49989 · Telegram Post