PT-2023-31947 · Unknown+1 · Thirty Bees+1

Ulaş Deniz İlhan · Published 2023-12-30 · Updated 2024-01-05 · CVE-2023-52264

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The beesblog (aka Bees Blog) component for thirty bees version 1.6.2 and earlier

Description The issue allows Reflected XSS because the sharing url in controllers/front/post.php is mishandled. This can lead to malicious scripts being injected into the website.

Recommendations For versions prior to 1.6.2, update to version 1.6.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the controllers/front/post.php file or disabling the sharing url parameter until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-52264

Affected Products

Beesblog

Thirty Bees

References · 10

• https://github.com/thirtybees/beesblog/compare/1.6.1...1.6.2 · Patch
• https://github.com/thirtybees/beesblog/commit/a3aeed8fcf01c8e4112c168cf2ef7d67c8056daf · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-52264 · Security Note
• https://osv.dev/vulnerability/CVE-2023-52264 · Vendor Advisory
• https://twitter.com/CVEnew/status/1741227543435579681 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1741273573480603742 · Twitter Post
• https://zigrin.com/advisories/thirty-bees-reflected-cross-site-scripting-vulnerability · Note
• https://t.me/cibsecurity/74046 · Telegram Post
• https://t.me/cvenotify/66456 · Telegram Post
• https://t.me/cvenotify/65822 · Telegram Post