PT-2024-24591 · Phlex · Phlex

Gregmolnar

·

Published

2024-04-17

·

Updated

2024-05-18

·

CVE-2024-32463

CVSS v3.1

7.1

High

VectorAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Name of the Vulnerable Software and Affected Versions phlex versions prior to 1.10.1 phlex versions prior to 1.9.2 phlex versions prior to 1.8.3 phlex versions prior to 1.7.2 phlex versions prior to 1.6.3 phlex versions prior to 1.5.3 phlex versions prior to 1.4.2
Description There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. The filter to detect and prevent the use of the javascript: URL scheme in the href attribute of an <a> tag could be bypassed with tab t or newline characters between the characters of the protocol, e.g. javatscript:. If you render an <a> tag with an href attribute set to a user-provided link, that link could potentially execute JavaScript when clicked by another user.
Recommendations For versions prior to 1.10.1, update to version 1.10.1. For versions prior to 1.9.2, update to version 1.9.2. For versions prior to 1.8.3, update to version 1.8.3. For versions prior to 1.7.2, update to version 1.7.2. For versions prior to 1.6.3, update to version 1.6.3. For versions prior to 1.5.3, update to version 1.5.3. For versions prior to 1.4.2, update to version 1.4.2. As a temporary workaround, consider configuring a Content Security Policy that does not allow unsafe-inline to prevent this vulnerability from being exploited.

Exploit

Fix

XSS

Weakness Enumeration

CWE-87CWE-79

Related Identifiers

CVE-2024-32463
GHSA-G7XQ-XV8C-H98C

Affected Products

Phlex