PT-2024-30175 · Unknown · Fastapi-Admin

Aprilliar13 · Published 2024-08-26 · Updated 2024-08-30 · CVE-2024-42816

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions fastapi-admin pro version 0.1.4

Description A cross-site scripting (XSS) vulnerability in the Create Product function allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter.

Recommendations For version 0.1.4, consider disabling the Create Product function until a patch is available. As a temporary workaround, restrict the use of the Product Name parameter in the Create Product function to minimize the risk of exploitation. Upgrade to version 0.1.5 to remediate the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-42816

GHSA-22XM-W7R2-834Q

Affected Products

Fastapi-Admin

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-42816 · Security Note
• https://osv.dev/vulnerability/GHSA-22xm-w7r2-834q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-42816 · Vendor Advisory
• https://github.com/fastapi-admin/fastapi-admin/issues/172 · Note
• https://github.com/fastapi-admin/fastapi-admin · Note
• https://t.me/cvedetector/4179 · Telegram Post
• https://twitter.com/CVEnew/status/1828111007559946410 · Twitter Post
• https://twitter.com/transilienceai/status/1829585333677113439 · Twitter Post
• https://fastapi-admin-pro.long2ice.io/admin/login · Note
• https://twitter.com/transilienceai/status/1829585327649898882 · Twitter Post