PT-2024-23652 · Unknown · Rageframe2

Hebing123 · Published 2024-04-11 · Updated 2024-10-27 · CVE-2024-30879

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions RageFrame2 version 2.6.43

Description The issue allows remote attackers to execute arbitrary web scripts or HTML and obtain sensitive information via a crafted payload injected into the boxId parameter in the image cropping function. This is a Reflected Cross Site Scripting (XSS) vulnerability.

Recommendations For RageFrame2 version 2.6.43, consider disabling the image cropping function until a patch is available to prevent exploitation of the boxId parameter. Restrict access to this function to minimize the risk of sensitive information being obtained by attackers.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-30879

Affected Products

Rageframe2

References · 5

• 🔥 https://github.com/jianyan74/rageframe2/issues/114 · Exploit
• https://osv.dev/vulnerability/CVE-2024-30879 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-30879 · Security Note
• https://t.me/cvenotify/99619 · Telegram Post
• https://t.me/cvenotify/76381 · Telegram Post