PT-2024-30198 · Syspass · Syspass

Nuxsmin · Published 2024-09-03 · Updated 2024-09-12 · CVE-2024-42904

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SysPass versions 3.2.x

Description A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the name parameter at the "/Controllers/ClientController.php" endpoint. This enables attackers to potentially execute arbitrary code.

Recommendations For SysPass version 3.2.x, update the system as soon as possible and validate inputs to prevent exploitation. Consider temporarily restricting access to the ClientController.php until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-42904

Affected Products

Syspass

References · 9

• 🔥 https://github.com/sysentr0py/CVEs/tree/main/CVE-2024-42904 · Exploit
• https://osv.dev/vulnerability/CVE-2024-42904 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42904 · Security Note
• https://github.com/nuxsmin/sysPass/blob/9d0e169d2163897238877fb65130db47fe1ddcfa/app/modules/api/Controllers/ClientController.php#L89 · Note
• https://github.com/nuxsmin/sysPass/blob/master/lib/SP/DataModel/ClientData.php#L98 · Note
• https://twitter.com/CVEnew/status/1831022264411701554 · Twitter Post
• https://twitter.com/oktsec/status/1831048113022222520 · Twitter Post
• https://t.me/cvedetector/4708 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1831075888768651767 · Twitter Post