PT-2023-11659 · Unknown · Laborator Kalium

Mohamed O. Medo · Published 2023-08-11 · Updated 2023-08-16 · CVE-2020-24075

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Laborator Kalium versions prior to 3.0.4

Description The issue is a Cross Site Scripting (XSS) vulnerability in the Name Input Field of the Contact Us form, allowing remote attackers to execute arbitrary code.

Recommendations For versions prior to 3.0.4, update to version 3.0.4 or later to resolve the issue. As a temporary workaround, consider disabling the Contact Us form or restricting access to it until the update is applied. Avoid using the Name Input Field in the Contact Us form until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-24075

Affected Products

Laborator Kalium

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-24075 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24075 · Vendor Advisory
• https://documentation.laborator.co/kb/kalium/kalium-changelog/#version-3-0-4-jun-23-2020 · Vendor Advisory
• https://twitter.com/CVEnew/status/1690263972044259328 · Twitter Post
• https://t.me/cibsecurity/68364 · Telegram Post
• https://t.me/cvenotify/56275 · Telegram Post