PT-2023-10253 · Openseamap · Openseamap Online Chart

Aaxee · Published 2023-02-07 · Updated 2024-05-17 · CVE-2015-10074

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenSeaMap online chart version 1.2

Description A vulnerability was found in the function init of the file index.php. The manipulation of the argument mtext leads to cross site scripting. It is possible to launch the attack remotely.

Recommendations For OpenSeaMap online chart version 1.2, upgrade to version staging to address this issue. As a temporary workaround, consider restricting access to the init function in the index.php file until the upgrade is applied. Additionally, avoid using the mtext argument in the affected component until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-10074

Affected Products

Openseamap Online Chart

References · 8

• https://github.com/OpenSeaMap/online_chart/releases/tag/staging · Patch
• https://github.com/OpenSeaMap/online_chart/commit/8649157158f921590d650e2d2f4bdf0df1017e9d · Patch
• https://github.com/OpenSeaMap/online_chart/pull/70 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-10074 · Security Note
• https://t.me/cvenotify/43759 · Telegram Post
• https://t.me/cvenotify/59791 · Telegram Post
• https://vuldb.com/?ctiid.220218 · Note
• https://vuldb.com/?id.220218 · Note