PT-2023-13423 · Vermeg · Vermeg Agilereporter

Crashpark · Published 2023-10-27 · Updated 2023-11-08 · CVE-2022-34834

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions VERMEG AgileReporter version 21.3

Description An issue was discovered in VERMEG AgileReporter where attackers can gain privileges via an XSS payload in an Add Comment action to the Activity log.

Recommendations For VERMEG AgileReporter version 21.3, consider disabling the Add Comment action to the Activity log until a patch is available to prevent exploitation via XSS payload.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-34834

Affected Products

Vermeg Agilereporter

References · 7

• 🔥 https://crashpark.weebly.com/blog/2-stored-xss-in-agilereporter-213-by-vermeg · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-34834 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34834 · Vendor Advisory
• https://vermeg.com/agile-reporter · Note
• https://twitter.com/CVEnew/status/1718013091609292995 · Twitter Post
• https://t.me/cibsecurity/73090 · Telegram Post
• https://twitter.com/DMFezzaReedCISA/status/1718029462057467987 · Twitter Post