PT-2024-23654 · Unknown · Rageframe2

Hebing123 · Published 2024-04-11 · Updated 2024-08-01 · CVE-2024-30880

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions RageFrame2 version 2.6.43

Description A Reflected Cross Site Scripting (XSS) issue allows remote attackers to execute arbitrary web scripts or HTML and obtain sensitive information via a crafted payload injected into the multiple parameter in the image cropping function.

Recommendations For RageFrame2 version 2.6.43, consider disabling the image cropping function until a patch is available to prevent exploitation of the Reflected Cross Site Scripting (XSS) issue. Restrict access to the multiple parameter in the image cropping function to minimize the risk of sensitive information disclosure.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-30880

Affected Products

Rageframe2

References · 4

• 🔥 https://github.com/jianyan74/rageframe2/issues/114 · Exploit
• https://osv.dev/vulnerability/CVE-2024-30880 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-30880 · Security Note
• https://t.me/cvenotify/76382 · Telegram Post