PT-2024-29434 · Cadclick · Cadclick

Pius Walter · Published 2024-10-04 · Updated 2024-10-07 · CVE-2024-41516

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CADClick versions up to 1.11.0

Description A Reflected cross-site scripting (XSS) vulnerability in "ccHandler.aspx" allows remote attackers to inject arbitrary web script or HTML via the bomid parameter. This vulnerability enables attackers to execute malicious scripts on the victim's browser.

Recommendations For CADClick versions up to 1.11.0, consider disabling access to the "ccHandler.aspx" page or restricting the use of the bomid parameter until a patch is available. Avoid using the bomid parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-41516

Affected Products

Cadclick

References · 8

• 🔥 https://piuswalter.de/blog/multiple-critical-vulnerabilities-in-cadclick · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-41516 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41516 · Vendor Advisory
• http://kimweb.de · Note
• https://t.me/cvedetector/7001 · Telegram Post
• https://twitter.com/CVEnew/status/1842259072323883426 · Twitter Post
• http://cadclick.de · Note
• https://twitter.com/VulmonFeeds/status/1842327596211568653 · Twitter Post