PT-2024-27728 · Openplc · Openplc

1D8 · Published 2024-06-28 · Updated 2024-07-03 · CVE-2024-37741

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenPLC versions 3 through 9cd8f1b

Description The issue allows for XSS via an SVG document when used as a profile picture.

Recommendations For versions 3 through 9cd8f1b, avoid using SVG documents as profile pictures until a fix is available. As a temporary workaround, consider restricting the upload of SVG files to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-37741

Affected Products

Openplc

References · 4

• 🔥 https://github.com/thiagoralves/OpenPLC_v3/issues/242 · Exploit
• 🔥 https://1d8.github.io/cves/cve_2024_37741 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-37741 · Security Note
• https://github.com/thiagoralves/OpenPLC_v3/blob/9cd8f1b53a50f9d38708096bfc72bcbb1ef47343/webserver/pages.py#L992 · Note