PT-2023-26657 · Decode · Openstamanager

Florian Walter · Published 2023-09-11 · Updated 2023-09-13 · CVE-2023-38878

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DevCode OpenSTAManager versions 2.4.24 through 2.4.47

Description A reflected cross-site scripting (XSS) vulnerability may allow a remote attacker to execute arbitrary JavaScript in the web browser of a victim by injecting a malicious payload into the error and error description parameters of 'oauth2.php'. This allows the attacker to execute malicious code in the context of the victim's web browser.

Recommendations For DevCode OpenSTAManager versions 2.4.24 through 2.4.47, consider disabling access to the 'oauth2.php' endpoint until a patch is available. Restrict input to the error and error description parameters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-38878

Affected Products

Openstamanager

References · 9

• 🔥 https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38878 · Exploit
• https://osv.dev/vulnerability/CVE-2023-38878 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38878 · Security Note
• https://github.com/devcode-it/openstamanager · Note
• https://twitter.com/VulmonFeeds/status/1701393858053951685 · Twitter Post
• https://t.me/cvenotify/58010 · Telegram Post
• https://t.me/cibsecurity/70241 · Telegram Post
• https://openstamanager.com · Note
• https://twitter.com/CVEnew/status/1701349340231397752 · Twitter Post