PT-2024-25793 · Unknown · Ordat Foss-Online

Simon Holl · Published 2024-09-12 · Updated 2024-09-18 · CVE-2024-34335

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ORDAT FOSS-Online versions prior to 2.24.01

Description A reflected cross-site scripting (XSS) vulnerability was discovered in the login page of ORDAT FOSS-Online. This issue allows for the execution of malicious scripts, potentially leading to unauthorized access or data theft. The vulnerability is exploited via the login page, but specific details about API endpoints, vulnerable parameters, or function names are not provided.

Recommendations For versions prior to 2.24.01, update to version 2.24.01 or later to resolve the issue. As a temporary workaround, consider restricting access to the login page until the update can be applied. Avoid using the login functionality in a way that could potentially exploit the reflected XSS vulnerability until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-34335

Affected Products

Ordat Foss-Online

References · 9

• 🔥 https://mind-bytes.de/cross-site-scripting-in-foss-online-cve-2024-34335 · Exploit
• https://osv.dev/vulnerability/CVE-2024-34335 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34335 · Security Note
• http://ordat.com · Note
• https://twitter.com/VulmonFeeds/status/1834331508745679020 · Twitter Post
• https://t.me/cvedetector/5515 · Telegram Post
• https://twitter.com/CVEnew/status/1834302037514752151 · Twitter Post
• https://t.me/cvenotify/94439 · Telegram Post
• http://foss-online.com · Note