PT-2024-31067 · Cemipark · Cemipark

Dariusz Goåda + 1 · Published 2024-05-09 · Updated 2024-05-14 · CVE-2024-4424

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CemiPark software versions 4.5, 4.7, 5.03

Description The access control in CemiPark software does not properly validate user-entered data, allowing a stored cross-site scripting (XSS) attack. The parameters used to enter data into the system lack appropriate validation, making it possible to smuggle in HTML/JavaScript code, which will be executed in the user's browser space.

Recommendations For version 4.5, update the input validation mechanism to properly check user-entered data. For version 4.7, implement robust validation for all parameters to prevent XSS attacks. For version 5.03, ensure that all user input is sanitized and validated to prevent code injection. As a temporary workaround, consider restricting user input to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-4424

Affected Products

Cemipark

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-4424 · Security Note
• https://cert.pl/posts/2024/05/CVE-2024-4423 · Note
• https://twitter.com/CVEnew/status/1789348941479207223 · Twitter Post
• https://cert.pl/en/posts/2024/05/CVE-2024-4423 · Note
• http://cemi.pl · Note