PT-2023-25010 · Unknown · Dmarcts-Report-Viewer

Xmit.Xyz · Published 2023-06-22 · Updated 2023-06-30 · CVE-2023-34796

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions dmarcts-report-viewer dashboard versions 1.1 through commit 8a1d882b4c481a05e296e9b38a7961e912146a0f

Description The issue allows unauthenticated attackers to execute arbitrary code via the org name or domain values, which is a cross-site scripting (XSS) vulnerability. This enables attackers to inject malicious scripts into the website, potentially leading to unauthorized access or data theft.

Recommendations For versions 1.1 through commit 8a1d882b4c481a05e296e9b38a7961e912146a0f, consider restricting access to the org name and domain values to prevent exploitation until a patch is available. As a temporary workaround, avoid using the org name and domain values in the dashboard until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-34796

Affected Products

Dmarcts-Report-Viewer

References · 5

• 🔥 https://xmit.xyz/security/dmarcd-for-death · Exploit
• https://github.com/techsneeze/dmarcts-report-viewer/pull/88 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34796 · Security Note
• https://osv.dev/vulnerability/CVE-2023-34796 · Vendor Advisory
• https://t.me/cvenotify/52891 · Telegram Post