PT-2024-32816 · Exment · Exment

Kentaro Ishii · Published 2024-10-17 · Updated 2024-10-21 · CVE-2024-47793

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Exment versions 6.1.4 and earlier Exment versions 5.0.11 and earlier

Description A stored cross-site scripting issue exists. When accessing the edit screen containing custom columns, such as images or files, an arbitrary script may be executed on the user's web browser.

Recommendations For Exment versions 6.1.4 and earlier, update to a version later than 6.1.4 to resolve the issue. For Exment versions 5.0.11 and earlier, update to a version later than 5.0.11 to resolve the issue. As a temporary workaround, consider restricting access to custom columns of type images or files in the edit screen until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-47793

Affected Products

Exment

References · 9

• https://osv.dev/vulnerability/CVE-2024-47793 · Vendor Advisory
• https://exment.net/docs/#/weakness/20241010 · Vendor Advisory
• https://exment.net/vulnerability-correspondence-version-6-1-5-and-5-0-12-released · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47793 · Security Note
• https://t.me/cvenotify/99046 · Telegram Post
• https://twitter.com/CVEnew/status/1847161300754817246 · Twitter Post
• https://t.me/cvenotify/98710 · Telegram Post
• https://t.me/cvedetector/8291 · Telegram Post
• https://jvn.jp/en/jp/JVN74538317 · Note