PT-2024-10837 · Unknown · Awesomestcode Livebot

Awesomestcode Livebot · Published 2024-03-25 · Updated 2024-05-17 · CVE-2020-36826

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions AwesomestCode LiveBot (affected versions not specified)

Description A vulnerability was found in AwesomestCode LiveBot, classified as problematic, affecting the function parseSend of the file js/parseMessage.js. This leads to cross-site scripting and can be launched remotely. It is recommended to verify all input to prevent attacks.

Recommendations As a temporary workaround, consider disabling the parseSend function until a patch is available. Upgrade to version 0.1 to address this issue. Restrict access to the js/parseMessage.js file to minimize the risk of exploitation. Verify all input to prevent attacks.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-36826

Affected Products

Awesomestcode Livebot

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2020-36826 · Security Note
• https://github.com/AwesomestCode/LiveBot/releases/tag/0.1 · Patch
• https://github.com/AwesomestCode/LiveBot/commit/57505527f838d1e46e8f93d567ba552a30185bfa · Patch
• https://osv.dev/vulnerability/CVE-2020-36826 · Vendor Advisory
• https://t.me/cvenotify/74558 · Telegram Post
• https://vuldb.com/?id.257784 · Note
• https://twitter.com/CVEnew/status/1772160122430644480 · Twitter Post
• https://twitter.com/oktsec/status/1773032775202820171 · Twitter Post
• https://vuldb.com/?ctiid.257784 · Note