PT-2024-32048 · Talent · Talent Software Bap Automation

Published 2024-09-25 · Updated 2024-09-26 · CVE-2024-4657

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions Talent Software BAP Automation versions before 30840

Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS, enabling attackers to execute malicious scripts. The estimated number of potentially affected devices worldwide is not provided. There is no information about real-world incidents where this issue was exploited.

Technical details about exploitation include the general concept of Stored XSS, where an attacker injects malicious code into a website, which is then stored on the server and executed when other users access the site. However, specific API endpoints, vulnerable parameters, or function names are not mentioned.

Recommendations For Talent Software BAP Automation versions before 30840, upgrade the affected component immediately to mitigate the risk of remote attack. As a temporary workaround, consider restricting access to the component until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-4657

Affected Products

Talent Software Bap Automation

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-4657 · Security Note
• https://t.me/latest_high_impact_cve/1214 · Telegram Post
• https://twitter.com/oktsec/status/1838951062985752751 · Twitter Post
• https://twitter.com/CVEnew/status/1838935412108410961 · Twitter Post
• https://twitter.com/CveFindCom/status/1838926774123602159 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1838948977389011306 · Twitter Post
• https://usom.gov.tr/bildirim/tr-24-1536 · Note
• https://t.me/cvedetector/6313 · Telegram Post
• https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-1536 · Note