PT-2024-21788 · Openpne · Optimelineplugin

Kentaro Ishii · Published 2024-03-05 · Updated 2025-01-15 · CVE-2024-27278

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenPNE Plugin "opTimelinePlugin" versions 1.2.11 and earlier

Description The issue allows an arbitrary script to be executed on the web browsers of other users when a user configures their profile with malicious contents on a site using the affected product. This is a cross-site scripting vulnerability.

Recommendations For versions 1.2.11 and earlier, update to a version later than 1.2.11 to resolve the issue. As a temporary workaround, consider restricting user profile configuration to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-27278

Affected Products

Optimelineplugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-27278 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27278 · Vendor Advisory
• http://openpne.jp/archives/13458 · Vendor Advisory
• https://t.me/cvenotify/107477 · Telegram Post
• https://twitter.com/CVEnew/status/1765180865506615665 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1765195493531849110 · Twitter Post
• https://jvn.jp/en/jp/JVN78084105 · Note