PT-2024-22865 · Unknown · Sourcecodester Todo List In Kanban Board

Burak · Published 2024-03-26 · Updated 2024-09-09 · CVE-2024-2935

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Todo List in Kanban Board version 1.0

Description A problematic issue has been found in the Add ToDo component, where the manipulation of the Todo argument leads to cross-site scripting. This issue can be exploited remotely. The exploit has been disclosed to the public and may be used.

Recommendations For version 1.0, consider disabling the Add ToDo component or restricting the manipulation of the Todo argument to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-2935

Affected Products

Sourcecodester Todo List In Kanban Board

References · 10

• 🔥 https://github.com/BurakSevben/CVEs/blob/main/To%20Do%20List%20App/To%20Do%20List%20App%20-%20Cross-Site-Scripting.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-2935 · Security Note
• https://osv.dev/vulnerability/CVE-2024-2935 · Vendor Advisory
• https://t.me/cvenotify/74748 · Telegram Post
• https://vuldb.com/?submit.304678 · Note
• https://sourcecodester.com · Note
• https://twitter.com/CVEnew/status/1772791187361214939 · Twitter Post
• https://t.me/cvenotify/93832 · Telegram Post
• https://vuldb.com/?id.258014 · Note
• https://vuldb.com/?ctiid.258014 · Note