PT-2023-20918 · Unknown · Mirotalk P2P

L4Rm4Nd · Published 2023-03-22 · Updated 2023-03-28 · CVE-2023-27054

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MiroTalk P2P versions before commit f535b35

Description A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under the settings module. This enables attackers to potentially manipulate the application's behavior or steal user data.

Recommendations For versions before commit f535b35, consider restricting access to the settings module until a patch is available. As a temporary workaround, avoid using the Name parameter in the settings module to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-27054

Affected Products

Mirotalk P2P

References · 8

• 🔥 https://github.com/miroslavpejic85/mirotalk/issues/139 · Exploit
• https://github.com/miroslavpejic85/mirotalk/commit/f535b3515d2d480dc3135b37982f5df93e43c592 · Patch
• https://osv.dev/vulnerability/CVE-2023-27054 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27054 · Security Note
• https://github.com/miroslavpejic85/mirotalk · Note
• https://t.me/cvenotify/46687 · Telegram Post
• https://t.me/cibsecurity/60536 · Telegram Post
• https://t.me/cvenotify/46683 · Telegram Post