PT-2023-10238 · Unknown · S134328 Webapplication-Veganguide

Published 2023-01-17 · Updated 2024-05-17 · CVE-2015-10059

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions s134328 Webapplication-Veganguide (affected versions not specified)

Description A vulnerability has been found in the s134328 Webapplication-Veganguide, classified as problematic. It affects unknown code of the file p05-integration/app/shared/api/apiService.js. The manipulation of the country/city argument leads to cross-site scripting. The attack can be initiated remotely.

Recommendations Apply a patch to fix this issue, specifically the patch named 2aa760fa4e779e40a28206a32ac22ac10356f519. As a temporary workaround, consider restricting access to the apiService.js file or disabling the manipulation of the country/city argument until the patch is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-10059

Affected Products

S134328 Webapplication-Veganguide

References · 5

• https://github.com/s134328/Webapplication-Veganguide/commit/2aa760fa4e779e40a28206a32ac22ac10356f519 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-10059 · Security Note
• https://t.me/cibsecurity/56586 · Telegram Post
• https://vuldb.com/?ctiid.218416 · Note
• https://vuldb.com/?id.218416 · Note