PT-2024-15256 · Zzdevelop · Lenosp

I7Xc2Yzz · Published 2024-05-24 · Updated 2024-08-02 · CVE-2023-7259

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:N/AC:L/Au:M/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions zzdevelop lenosp versions up to 20230831

Description A disputed issue affects an unknown part of the Adduser Page component. The manipulation of the username argument with the input <script>alert(1)</script> leads to cross-site scripting. This can be initiated remotely. The real existence of this issue is still doubted, and the vendor has rejected it, claiming that cross-site scripting requiring administrative privileges is not useful for attackers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-7259

Affected Products

Lenosp

References · 4

• 🔥 https://gitee.com/zzdevelop/lenosp/issues/I7XC2Y · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-7259 · Security Note
• https://vuldb.com/?ctiid.266127 · Note
• https://vuldb.com/?id.266127 · Note