PT-2024-20427 · Act-On · Act-On

Alexandre Rodrigo Da Silva · Published 2024-07-22 · Updated 2024-09-05 · CVE-2024-24507

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Act-On version 2023

Description The issue allows a remote attacker to execute arbitrary code via the newUser parameter in the "login.jsp" component. This enables the attacker to perform Cross Site Scripting attacks.

Recommendations For Act-On version 2023, consider disabling the newUser parameter in the "login.jsp" component as a temporary workaround until a patch is available. Restrict access to the "login.jsp" component to minimize the risk of exploitation. Avoid using the newUser parameter in the affected component until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-24507

Affected Products

Act-On

References · 6

• 🔥 https://gist.github.com/Xandsz/2b409acb81e846fc3478600f984785a1 · Exploit
• https://osv.dev/vulnerability/CVE-2024-24507 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24507 · Security Note
• https://t.me/cvenotify/93411 · Telegram Post
• https://t.me/cvedetector/1490 · Telegram Post
• https://t.me/cvenotify/87092 · Telegram Post