PT-2024-30296 · Hubbank · Hubbank

David Utón Amaya · Published 2024-04-29 · Updated 2025-04-23 · CVE-2024-4310

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions HubBank version 1.0.2

Description The issue is a Cross-site Scripting (XSS) vulnerability that allows an attacker to send a specially crafted JavaScript payload to registration and profile forms. This payload can be triggered when any authenticated user loads the page, resulting in a session takeover.

Recommendations For version 1.0.2, consider disabling the registration and profile forms temporarily until a patch is available to prevent exploitation of the XSS vulnerability. Restrict access to these forms to minimize the risk of session takeover. Avoid using the vulnerable forms in the affected version until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-4310

Affected Products

Hubbank

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-4310 · Security Note
• https://osv.dev/vulnerability/CVE-2024-4310 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1784956792792928476 · Twitter Post
• https://t.me/cvenotify/78401 · Telegram Post
• https://twitter.com/linuxpatch/status/1784949086723932205 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-hubbank · Note
• https://t.me/cvenotify/119571 · Telegram Post
• https://t.me/cvenotify/78522 · Telegram Post