PT-2024-22946 · Unknown · Dcat-Admin

Published 2024-03-26 · Updated 2025-03-24 · CVE-2024-29644

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions dcat-admin versions 2.1.3 and earlier

Description A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via a crafted script to the user login box. This enables the attacker to perform unauthorized actions on the affected system.

Recommendations For dcat-admin versions 2.1.3 and earlier, update to a version later than 2.1.3 to resolve the issue. As a temporary workaround, consider restricting access to the user login box to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-29644

GHSA-MR24-CF69-5CHQ

Affected Products

Dcat-Admin

References · 11

• 🔥 https://yuque.com/yangtu-swjrh/oc6nqi/epcbz5y1grl4il1m · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-29644 · Security Note
• https://osv.dev/vulnerability/GHSA-mr24-cf69-5chq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-29644 · Vendor Advisory
• https://github.com/jqhph/dcat-admin · Note
• https://twitter.com/VulmonFeeds/status/1772634676328341835 · Twitter Post
• http://dcat-admin.com · Note
• https://t.me/cvenotify/89260 · Telegram Post
• https://twitter.com/CVEnew/status/1772601379485327383 · Twitter Post
• https://t.me/cvenotify/74669 · Telegram Post
• https://t.me/cvenotify/115927 · Telegram Post