PT-2024-21381 · Unknown · Healthcare-Chatbot

Piggyctf · Published 2024-03-15 · Updated 2024-03-15 · CVE-2024-26454

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Healthcare-Chatbot versions through 9b7058a

Description A Cross Site Scripting issue can occur via a crafted payload to the email1 or pwd1 parameter in "login.php".

Recommendations For Healthcare-Chatbot versions through 9b7058a, as a temporary workaround, consider restricting access to the "login.php" endpoint until a patch is available. Avoid using the parameters email1 and pwd1 in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-26454

Affected Products

Healthcare-Chatbot

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-26454 · Security Note
• https://github.com/OmRajpurkar/Healthcare-Chatbot/issues/4 · Note
• https://medium.com/%400x0d0x0a/healthcare-chatbot-xss-cve-2024-26454-acf2607bf210 · Note
• https://t.me/cvenotify/73921 · Telegram Post