PT-2023-27901 · Tolgee · Tolgee

Mbiesiad · Published 2023-09-07 · Updated 2023-09-13 · CVE-2023-41316

Positive Technologies · (AI Summary)

CVSS v3.1

5.5

5.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions:

Tolgee versions prior to 3.29.2

Description:

Tolgee is an open-source localization platform. Due to a lack of validation in the `Org Name` field, a bad actor can send emails with HTML injected code to victims. Registered users can inject HTML into unsanitized emails from the Tolgee instance to other users, which ends up in invitation emails appearing as legitimate org invitations. Bad actors may direct users to a malicious website or execute JavaScript in the context of the user's browser.

Recommendations:

For versions prior to 3.29.2, upgrade to version 3.29.2 to address the vulnerability. As a temporary workaround, consider restricting the use of the `Org Name` field until the upgrade is applied. Avoid using the `Org Name` field in a way that could allow HTML injection until the issue is resolved.

Exploit

Fix

RCE

XSS

Weakness Enumeration

CWE-20

CWE-79

Related Identifiers

CVE-2023-41316

GHSA-GX3W-RWH5-W5CG

Affected Products

Tolgee

References · 8

• 🔥 https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-gx3w-rwh5-w5cg · Exploit
• https://github.com/tolgee/tolgee-platform/commit/bab718b1c9b3e90327bfb10d27b9799996e5c35b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-41316 · Security Note
• https://osv.dev/vulnerability/CVE-2023-41316 · Vendor Advisory
• https://twitter.com/CVEnew/status/1699873353635373175 · Twitter Post
• https://t.me/cibsecurity/70113 · Telegram Post
• https://t.me/cvenotify/57762 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1699912402467270883 · Twitter Post