PT-2023-29775 · Unknown · Thirty Bees Core

Ulaş Deniz İlhan · Published 2023-10-18 · Updated 2023-10-25 · CVE-2023-45958

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Thirty Bees Core version 1.4.0

Description The issue is a reflected cross-site scripting (XSS) vulnerability. It allows attackers to execute arbitrary JavaScript in a user's web browser via a crafted payload. The vulnerability is exploited through the backup pagination parameter at the /controller/AdminController.php endpoint.

Recommendations For Thirty Bees Core version 1.4.0, consider disabling access to the /controller/AdminController.php endpoint until a patch is available. As a temporary workaround, restrict the use of the backup pagination parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-45958

Affected Products

Thirty Bees Core

References · 6

• https://github.com/thirtybees/thirtybees/commit/2c99464376ad7b3c95f220163a2411e35274c3ba · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-45958 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45958 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1714804515344462025 · Twitter Post
• https://twitter.com/CVEnew/status/1714766947852628029 · Twitter Post
• https://zigrin.com/advisories/thirty-bees-reflected-cross-site-scripting-xss · Note