PT-2024-11205 · Kossy · Kossy

Kfly8 · Published 2024-03-17 · Updated 2024-11-25 · CVE-2021-47157

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kossy module versions prior to 0.60

Description The issue allows JSON hijacking due to mishandling of the X-Requested-With header. This can be exploited because of improper handling in the Kossy module for Perl.

Recommendations For versions prior to 0.60, update to version 0.60 or later to resolve the issue. As a temporary workaround, consider restricting access to the Kossy module to minimize the risk of exploitation.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2021-47157

Affected Products

Kossy

References · 6

• https://osv.dev/vulnerability/CVE-2021-47157 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47157 · Security Note
• https://github.com/kazeburo/Kossy/pull/16 · Note
• https://twitter.com/CVEnew/status/1769587703933477251 · Twitter Post
• https://metacpan.org/dist/Kossy/changes · Note
• https://t.me/cvenotify/74125 · Telegram Post