PT-2024-31831 · Baltic It · Topqw Webportal+1

Majid Lakhnati + 1 · Published 2024-11-13 · Updated 2024-11-15 · CVE-2024-45879

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions baltic-it TOPqw Webportal versions 1.35.287.1 through 1.35.290

Description The issue concerns a Cross-Site Scripting (XSS) vulnerability in the file upload function of the "QWKalkulation" tool. To exploit this vulnerability, an attacker must be authenticated to the application using the "TOPqw Webportal". Once authenticated, the attacker can persistently place malicious JavaScript code in the "QWKalkulation" menu. The vulnerable endpoint is /Apps/TOPqw/QWKalkulation/QWKalkulation.aspx.

Recommendations For versions 1.35.287.1 through 1.35.290, update to version 1.35.291 to resolve the issue. As a temporary workaround, consider restricting access to the "QWKalkulation" tool and the file upload function in /Apps/TOPqw/QWKalkulation/QWKalkulation.aspx to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-45879

Affected Products

Qwkalkulation

Topqw Webportal

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-45879 · Security Note
• https://t.me/cvedetector/10877 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1856948993772704151 · Twitter Post
• https://cyber.wtf/2024/11/11/topqw-webportal-cves · Note
• https://twitter.com/CVEnew/status/1856828054804590642 · Twitter Post