PT-2024-14791 · Megabip+1 · Megabip+1

Published 2024-01-29 · Updated 2024-10-10 · CVE-2023-5378

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MegaBIP versions up to 4.36.2 SmodBIP all versions

Description The issue is related to an Improper Input Validation vulnerability that allows for Stored XSS. This vulnerability affects MegaBIP in versions up to 4.36.2 and SmodBIP in all versions. MegaBIP version 5.08 has been tested and is not vulnerable.

Recommendations For MegaBIP versions up to 4.36.2, update to a version newer than 4.36.2 to resolve the issue. For SmodBIP all versions, since the software is already unsupported, consider alternative solutions or manually patch the software if possible. As a temporary workaround, consider implementing additional input validation mechanisms to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-5378

Affected Products

Megabip

Smodbip

References · 9

• https://osv.dev/vulnerability/CVE-2023-5378 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5378 · Security Note
• https://t.me/cvenotify/69045 · Telegram Post
• https://t.me/cvenotify/71898 · Telegram Post
• https://smod.pl · Note
• https://cert.pl/posts/2023/12/CVE-2023-5378 · Note
• https://twitter.com/CVEnew/status/1751929166637801793 · Twitter Post
• https://megabip.pl · Note
• https://cert.pl/en/posts/2023/12/CVE-2023-5378 · Note