PT-2024-21177 · Enhavo · Enhavo

Daniel Puente · CVE-2024-25873 · Published 2024-02-22 · Updated 2024-08-26

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Enhavo version 0.13.1

Description The issue is related to an HTML injection vulnerability in the Author text field under the Blockquote module. This allows attackers to execute arbitrary code via a crafted payload.

Recommendations For Enhavo version 0.13.1, consider disabling the Author text field under the Blockquote module as a temporary workaround until a patch is available. Restrict access to this module to minimize the risk of exploitation. Avoid using the Author text field in the Blockquote module until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2024-25873

Affected Products

Enhavo

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25873.json · Exploit
• 🔥 https://github.com/dd3x3r/enhavo/blob/main/html-injection-page-content-blockquote-author-v0.13.1.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-25873 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25873 · Security Note
• https://enhavo.com · Note
• https://twitter.com/CVEnew/status/1760663822644208125 · Twitter Post
• https://t.me/cvenotify/72205 · Telegram Post
• https://t.me/cvenotify/92227 · Telegram Post