PT-2024-21976 · Supercali · Supercali

Published 2024-03-05 · Updated 2024-08-05 · CVE-2024-27627

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SuperCali version 1.1.0

Description A reflected cross-site scripting (XSS) issue exists, allowing remote attackers to execute arbitrary JavaScript code via the email parameter in the "bad password.php" page. This could potentially affect a significant number of devices worldwide, although the exact number is not specified.

Recommendations For SuperCali version 1.1.0, consider disabling access to the "bad password.php" page or restricting the use of the email parameter until a patch is available. As a temporary workaround, avoid using the email parameter in the affected page to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-27627

Affected Products

Supercali

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-27627 · Security Note
• https://t.me/cvenotify/73020 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1765035873437966379 · Twitter Post
• https://t.me/cvenotify/89253 · Telegram Post
• https://twitter.com/CVEnew/status/1765018256619004295 · Twitter Post
• https://packetstormsecurity.com/files/177254/SuperCali-1.1.0-Cross-Site-Scripting.html · Note