PT-2023-31712 · Unknown · Englesystem

Skruppy · Published 2023-12-22 · Updated 2024-01-05 · CVE-2023-50924

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Englesystem versions prior to 3.4.1

Description Englesystem is a shift planning system for chaos events. The system performed insufficient validation of user-supplied data for the DECT number, mobile number, and work-log comment fields. This allowed the injection and execution of Javascript code in another user's context, enabling an authenticated user to inject Javascript into other users' sessions. The injected JS will be executed during normal usage of the system when viewing overview pages.

Recommendations For versions prior to 3.4.1, update to version 3.4.1 to resolve the issue. As a temporary workaround, consider restricting access to the log overview pages to minimize the risk of exploitation. Additionally, avoid using the DECT number, mobile number, and work-log comment fields until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-50924

GHSA-P5CH-RRPM-WVHM

Affected Products

Englesystem

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50924.json · Exploit
• https://github.com/engelsystem/engelsystem/security/advisories/GHSA-p5ch-rrpm-wvhm · Patch
• https://github.com/engelsystem/engelsystem/commit/efda1ffc1ce59f02a7d237d9087adea26e73ec5f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-50924 · Security Note
• https://osv.dev/vulnerability/CVE-2023-50924 · Vendor Advisory
• https://twitter.com/CVEnew/status/1738301544779727353 · Twitter Post
• https://t.me/cvenotify/66356 · Telegram Post
• https://twitter.com/cracbot/status/1738624149638033773 · Twitter Post