PT-2024-28478 · Dotadmin · Dotadmin

Zakaria Agharghar · Published 2024-07-25 · Updated 2024-08-13 · CVE-2024-3938

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions dotAdmin (affected versions not specified)

Description The "reset password" login page accepted an HTML injection via URL parameters. This issue has already been rectified via a patch. The vulnerability can be demonstrated by accessing the "http://localhost:8082/dotAdmin/#/public/login?resetEmailSent=true&resetEmail=%3Ch1%3E%3Ca%20href%3D%22https:%2F%2Fgoogle.com%22%3ECLICK%20ME%3C%2Fa%3E%3C%2Fh1%3E" endpoint, which results in an HTML injection. The issue is related to OWASP Top 10 - A03: Injection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

RCE

Weakness Enumeration

CWE-79

CWE-20

Related Identifiers

CVE-2024-3938

Affected Products

Dotadmin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-3938 · Security Note
• https://osv.dev/vulnerability/CVE-2024-3938 · Vendor Advisory
• https://dotcms.com/security/SI-71 · Vendor Advisory
• https://t.me/cvenotify/90303 · Telegram Post
• https://t.me/cvedetector/1657 · Telegram Post
• https://t.me/cvenotify/87573 · Telegram Post