PT-2023-32770 · Unknown · Amazing Little Poll

David Utón Amaya + 1 · Published 2023-12-13 · Updated 2023-12-22 · CVE-2023-6769

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Amazing Little Poll versions 1.3 through 1.4

Description The issue is a Stored XSS vulnerability that allows a remote attacker to store a malicious JavaScript payload in the "lp admin.php" file using the question and item parameters. This could lead to malicious JavaScript execution while the page is loading.

Recommendations For versions 1.3 and 1.4, consider disabling access to the "lp admin.php" file or restricting the use of the question and item parameters until a patch is available. As a temporary workaround, avoid using the question and item parameters in the affected API endpoint.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-6769

Affected Products

Amazing Little Poll

References · 7

• https://osv.dev/vulnerability/CVE-2023-6769 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6769 · Security Note
• https://twitter.com/VulmonFeeds/status/1737436784651370616 · Twitter Post
• https://t.me/cvenotify/64366 · Telegram Post
• https://twitter.com/CVEnew/status/1737416052907417688 · Twitter Post
• https://twitter.com/David_Uton/status/1734985279310569888 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amazing-little-poll · Note