PT-2024-27822 · Unknown · Wbsairback

Alejandro Amorín Niño + 3 · Published 2024-04-15 · Updated 2025-04-10 · CVE-2024-3791

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WBSAirback version 21.02.04

Description The issue is a stored Cross-Site Scripting (XSS) vulnerability. It occurs through the /admin/SystemConfiguration endpoint, specifically in the name and free memory limit fields, and the type and password parameters. This could allow a remote user to send a specially crafted URL to the victim and steal their session data.

Recommendations For WBSAirback version 21.02.04, consider disabling access to the /admin/SystemConfiguration endpoint until a patch is available. Restrict input for the name and free memory limit fields, as well as the type and password parameters, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-3791

Affected Products

Wbsairback

References · 5

• https://osv.dev/vulnerability/CVE-2024-3791 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3791 · Security Note
• https://twitter.com/CVEnew/status/1779879082957971671 · Twitter Post
• https://t.me/cvenotify/118746 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions · Note