PT-2023-19921 · Adm+2 · Adm+2

Published 2023-05-17 · Updated 2023-05-26 · CVE-2023-2509

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions ADM versions 4.0.6.REG2 through 4.1.0 ADM versions 4.2.1.RGE2 and below LooksGood versions 2.0.0.R129 and below SoundsGood versions 2.3.0.r1027 and below

Description A Cross-Site Scripting(XSS) issue was found in the ADM, LooksGood, and SoundsGood Apps. This allows an attacker to inject malicious scripts into the target applications, accessing cookies or sensitive information retained by the browser and used with that application.

Recommendations For ADM versions 4.0.6.REG2 through 4.1.0, update to a version above 4.1.0. For ADM versions 4.2.1.RGE2 and below, update to a version above 4.2.1.RGE2. For LooksGood versions 2.0.0.R129 and below, update to a version above 2.0.0.R129. For SoundsGood versions 2.3.0.r1027 and below, update to a version above 2.3.0.r1027. As a temporary workaround, consider restricting access to sensitive information in the affected applications until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-2509

Affected Products

Adm

Looksgood

Soundsgood

References · 4

• https://osv.dev/vulnerability/CVE-2023-2509 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2509 · Security Note
• https://asustor.com/security/security_advisory_detail?id=22 · Vendor Advisory
• https://t.me/cibsecurity/64304 · Telegram Post