PT-2024-29651 · I · I

Alessio-Romano · Published 2024-07-30 · Updated 2024-07-31 · CVE-2024-41943

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions I, Librarian versions prior to 5.11.1

Description The issue arises from the lack of validation or sanitation of PDF notes displayed on the Item Summary page. An attacker can exploit this by inserting a malicious payload into the PDF notes, which will be executed when the page is loaded in the browser.

Recommendations For versions prior to 5.11.1, update to version 5.11.1 to resolve the issue. As a temporary workaround, consider restricting access to the Item Summary page or disabling the display of PDF notes until the update can be applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-41943

GHSA-H5HX-FM7F-2XMX

Affected Products

I

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41943.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-41943 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41943 · Vendor Advisory
• https://github.com/mkucej/i-librarian-free/security/advisories/GHSA-h5hx-fm7f-2xmx · Note
• https://github.com/mkucej/i-librarian-free/commit/b4570103d21fc4fdd2483689aafc6028d9f6a76d · Note
• https://t.me/cvenotify/87951 · Telegram Post
• https://t.me/cvedetector/2057 · Telegram Post