PT-2024-14301 · Ofcms · Ofcms

Phantom4Me · Published 2024-01-16 · Updated 2024-01-23 · CVE-2023-51807

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OFCMS version 1.14

Description A Cross Site Scripting issue allows a remote attacker to obtain sensitive information via a crafted payload to the title addition component. This enables the attacker to execute malicious scripts, potentially leading to unauthorized access or data breaches.

Recommendations For OFCMS version 1.14, consider disabling the title addition component until a patch is available to prevent exploitation. Restrict access to sensitive information and monitor for suspicious activity. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-51807

Affected Products

Ofcms

References · 8

• 🔥 https://github.com/Phantom4me/CVE-Management/blob/main/CVE-2023-51807.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-51807 · Security Note
• https://osv.dev/vulnerability/CVE-2023-51807 · Vendor Advisory
• https://gitee.com/oufu/ofcms · Note
• https://twitter.com/CVEnew/status/1747458216781390007 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1747429551582351666 · Twitter Post
• https://twitter.com/Esparta6108713/status/1747401721566118399 · Twitter Post
• https://gitee.com/oufu/ofcms/issues/I7OAU2 · Note