PT-2024-20377 · Xunruicms · Xunruicms

薛定谔的第二滴 · Published 2024-02-02 · Updated 2024-02-08 · CVE-2024-24388

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions XunRuiCMS versions v4.6.2 and before

Description A cross-site scripting (XSS) issue allows remote attackers to obtain sensitive information via crafted malicious requests to the background login. This can be achieved by sending malicious requests to the background login endpoint.

Recommendations For versions v4.6.2 and before, update to a version later than v4.6.2 to resolve the issue. As a temporary workaround, consider restricting access to the background login endpoint to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-24388

Affected Products

Xunruicms

References · 6

• 🔥 https://cnblogs.com/rxtycc/p/17948379 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-24388 · Security Note
• https://osv.dev/vulnerability/CVE-2024-24388 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1753383245918445741 · Twitter Post
• https://twitter.com/CVEnew/status/1753355747700641819 · Twitter Post
• https://t.me/cvenotify/69754 · Telegram Post