PT-2024-27743 · Sunbird · Sunbird Dcim Dctrack

Published 2024-12-16 · Updated 2024-12-17 · CVE-2024-37773

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sunbird DCIM dcTrack version 9.1.2

Description An HTML injection issue allows attackers authenticated as administrators to inject arbitrary HTML code in an admin screen. This can be exploited by attackers with administrative access to inject malicious HTML code.

Recommendations For Sunbird DCIM dcTrack version 9.1.2, consider restricting access to the admin screen until a patch is available. As a temporary workaround, limit the ability of administrators to inject HTML code in the admin panel to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-37773

Affected Products

Sunbird Dcim Dctrack

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-37773 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37773 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1868932922528403666 · Twitter Post
• https://twitter.com/CVEnew/status/1868775728629645730 · Twitter Post
• http://dctrack.com · Note
• https://t.me/cvenotify/104463 · Telegram Post
• https://s3.us-east-1.amazonaws.com/dcTrack.Docs/dcTrack_9.2.0_GA/dcTrack_9.2.0_Release_Notes.pdf · Note
• https://t.me/cvedetector/13049 · Telegram Post