PT-2024-19694 · Xiexe · Xiexe Xsoverlay

Ryotak · Published 2024-08-15 · Updated 2024-08-19 · CVE-2024-23168

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xiexe XSOverlay versions prior to build 647

Description The issue allows non-local websites to send malicious commands to the WebSocket API, resulting in arbitrary code execution.

Recommendations For versions prior to build 647, update to build 647 or later to resolve the issue. As a temporary workaround, consider restricting access to the WebSocket API until a patch is available.

Fix

Weakness Enumeration

CWE-1385

Related Identifiers

CVE-2024-23168

Affected Products

Xiexe Xsoverlay

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-23168 · Security Note
• https://github.com/Xiexe/XSOverlay-Issue-Tracker · Note
• https://t.me/cvenotify/91105 · Telegram Post
• https://twitter.com/CVEnew/status/1824149027627172122 · Twitter Post
• https://vuln.ryotak.net/advisories/70 · Note
• https://store.steampowered.com/news/app/1173510?emclan=103582791465938574&emgid=7792991106417394332 · Note
• https://t.me/cvedetector/3279 · Telegram Post