PT-2024-19564 · Unknown · Ca17 Teamsacs

Fuomag9 · Published 2024-04-02 · Updated 2024-12-04 · CVE-2024-22780

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CA17 TeamsACS version 1.0.1

Description A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via a crafted script to the errmsg parameter. This enables the attacker to perform unauthorized actions on the affected system.

Recommendations For CA17 TeamsACS version 1.0.1, consider restricting access to the errmsg parameter to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the errmsg parameter in sensitive operations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-22780

GHSA-HWVW-GH23-QPVQ

GO-2024-2684

Affected Products

Ca17 Teamsacs

References · 12

• https://osv.dev/vulnerability/GHSA-hwvw-gh23-qpvq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22780 · Security Note
• https://osv.dev/vulnerability/GO-2024-2684 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-22780 · Vendor Advisory
• https://github.com/CA17/TeamsACS · Note
• https://github.com/CA17/TeamsACS/issues/26 · Note
• https://t.me/cvenotify/75516 · Telegram Post
• http://ca17.com · Note
• https://twitter.com/VulmonFeeds/status/1775198483248525562 · Twitter Post
• https://fuo.fi/CVE-2024-22780 · Note
• https://twitter.com/CVEnew/status/1775168596882194584 · Twitter Post
• https://github.com/advisories/GHSA-hwvw-gh23-qpvq · Note