PT-2024-19514 · Livesite · Livesite

Tmrswrr · Published 2024-01-25 · Updated 2024-04-23 · CVE-2024-22638

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions liveSite version 2019.1

Description The issue is related to a remote code execution (RCE) via the components "/livesite/edit designer region.php" or "/livesite/add email campaign.php".

Recommendations For liveSite version 2019.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the "/livesite/edit designer region.php" and "/livesite/add email campaign.php" components to minimize the risk of exploitation.

Exploit

Related Identifiers

CVE-2024-22638

Affected Products

Livesite

References · 7

• 🔥 https://packetstormsecurity.com/files/176420/liveSite-2019.1-Remote-Code-Execution.html · Exploit
• https://osv.dev/vulnerability/CVE-2024-22638 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22638 · Security Note
• https://t.me/cvenotify/77823 · Telegram Post
• https://exploit-db.com/exploits/51936 · Note
• https://twitter.com/CVEnew/status/1750619153516646622 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1750667974002758144 · Twitter Post