PT-2024-29449 · Unknown · Learning With Texts

Published 2024-08-21 · Updated 2024-09-11 · CVE-2024-41572

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Learning with Texts (LWT) version 2.0.3

Description The issue is related to Cross Site Scripting (XSS), where the application fails to filter special characters in URL parameters, allowing remote attackers to inject JavaScript code without authorization. This can lead to the theft of user credentials or the execution of malicious actions, such as injecting scripts or redirecting users to malicious sites.

Recommendations For Learning with Texts (LWT) version 2.0.3, consider disabling the function that handles URL parameters until a patch is available to prevent the injection of malicious JavaScript code. Restrict access to sensitive areas of the application to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-41572

Affected Products

Learning With Texts

References · 8

• https://osv.dev/vulnerability/CVE-2024-41572 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41572 · Security Note
• https://t.me/cvenotify/91824 · Telegram Post
• https://twitter.com/CVEnew/status/1826339607836778812 · Twitter Post
• https://medium.com/%40ChadSecurity/cve-2024-41572-68397fae354b · Note
• https://t.me/cvedetector/3822 · Telegram Post
• https://t.me/cvenotify/91707 · Telegram Post
• https://t.me/cvenotify/93595 · Telegram Post