PT-2023-19767 · Dromara · Dromara J2Eefast

南风过境-梦至西洲 · Published 2023-05-02 · Updated 2024-05-17 · CVE-2023-2476

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dromara J2eeFAST versions up to 2.6.0

Description A problematic issue was found in the Announcement Handler component. The manipulation of the argument 系统工具/公告管理 or ????/???? leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations For Dromara J2eeFAST versions up to 2.6.0, apply a patch to fix this issue. The patch name is 7a9e1a00e3329fdc0ae05f7a8257cce77037134d. As a temporary workaround, consider restricting access to the Announcement Handler component until the patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-2476

Affected Products

Dromara J2Eefast

References · 7

• 🔥 https://gitee.com/dromara/J2EEFAST/issues/I6W380 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-2476 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2476 · Vendor Advisory
• https://gitee.com/dromara/J2EEFAST/commit/7a9e1a00e3329fdc0ae05f7a8257cce77037134d · Patch
• https://vuldb.com/?ctiid.227868 · Note
• https://vuldb.com/?id.227868 · Note
• https://t.me/cibsecurity/63160 · Telegram Post