PT-2024-23057 · Softlab · Softlab Radio Player

Abu Hurayra + 1 · Published 2024-03-27 · Updated 2025-05-13 · CVE-2024-29811

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions SoftLab Radio Player versions 2.0.73 and earlier

Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This means that an attacker can inject malicious scripts into the web page, which can then be executed by other users, potentially leading to unauthorized actions or data theft.

Recommendations For versions 2.0.73 and earlier, update to a version later than 2.0.73 to resolve the issue. As a temporary workaround, consider restricting user input to prevent malicious scripts from being injected into the web page. Avoid using the vulnerable Radio Player until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-29811

Affected Products

Softlab Radio Player

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-29811 · Security Note
• https://osv.dev/vulnerability/CVE-2024-29811 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1773003106885800182 · Twitter Post
• https://twitter.com/CVEnew/status/1772963719850406040 · Twitter Post
• https://t.me/cvenotify/121984 · Telegram Post
• https://patchstack.com/database/vulnerability/radio-player/wordpress-radio-player-plugin-2-0-73-cross-site-scripting-xss-vulnerability?_s_id=cve · Note