PT-2024-26897 · Unknown · Ansibleguy-Webui

Ntrampham · Published 2024-05-28 · Updated 2024-05-29 · CVE-2024-36110

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions ansibleguy-webui versions prior to 0.0.21

Description The issue allows injection of HTML elements in multiple forms, which are then evaluated by the browser after job actions are executed. This can lead to potential security risks. There are no known workarounds for these issues.

Recommendations For versions prior to 0.0.21, upgrade to version 0.0.21 or later to resolve the issue. As a temporary workaround, consider restricting the use of the affected forms until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-36110

GHSA-927P-XRC2-X2GJ

Affected Products

Ansibleguy-Webui

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36110.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-36110 · Security Note
• https://osv.dev/vulnerability/GHSA-927p-xrc2-x2gj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-36110 · Vendor Advisory
• https://github.com/ansibleguy/webui/issues/44 · Note
• https://github.com/ansibleguy/webui/security/advisories/GHSA-927p-xrc2-x2gj · Note
• https://github.com/ansibleguy/webui · Note
• https://github.com/ansibleguy/webui/files/15358522/Report.pdf · Note
• https://github.com/ansibleguy/webui/commit/7737b47e7f7ddbfec7b1418c724598363718d522 · Note