PT-2024-31780 · Fluxcp · Fluxcp

Singe-Horizontal · Published 2024-09-16 · Updated 2024-09-20 · CVE-2024-45799

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: FluxCP versions prior to 1.3

Description: A JavaScript injection is possible via vendors/buyers list pages and shop names that are not sanitized, allowing the execution of arbitrary JavaScript code on the user's browser. This can result in the theft of session information for all logged-in FluxCP users.

Recommendations: For versions prior to 1.3, upgrade to release version 1.3 to address the issue. As a temporary workaround, consider restricting access to the vendors/buyers list pages and shop names until the upgrade is applied. Avoid using the vulnerable pages until the issue is resolved.

Exploit

Fix

Information Disclosure

XSS

Weakness Enumeration

CWE-200

CWE-79

Related Identifiers

CVE-2024-45799

GHSA-XVQV-25VF-88G4

Affected Products

Fluxcp

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45799.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-45799 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45799 · Vendor Advisory
• https://github.com/rathena/FluxCP/security/advisories/GHSA-xvqv-25vf-88g4 · Note
• https://twitter.com/CVEnew/status/1835751625388069197 · Twitter Post
• https://twitter.com/cracbot/status/1837371272562626925 · Twitter Post
• https://t.me/cvedetector/5755 · Telegram Post
• https://twitter.com/cracbot/status/1837008885028376654 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1835780344592630209 · Twitter Post
• https://twitter.com/cracbot/status/1836646508340613590 · Twitter Post
• https://twitter.com/oktsec/status/1835925220827275485 · Twitter Post