PT-2024-32828 · Unknown · Lara-Zeus Dynamic Dashboard

Sharmaraghs · Published 2024-10-07 · Updated 2024-10-10 · CVE-2024-47817

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Lara-zeus Dynamic Dashboard versions 3.0.0 through 3.0.2

Description The issue arises when invalid values containing specific characters are passed to a paragraph widget, making applications vulnerable to an XSS attack against users who open a page where the paragraph widget is rendered. There are no known workarounds for this vulnerability.

Recommendations For Lara-zeus Dynamic Dashboard versions 3.0.0 through 3.0.2, upgrade to version 3.0.2 to resolve the issue. After upgrading, if you have published the view (blade files), you need to republish them or check the changes on the release to update the affected file.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-47817

GHSA-C6CW-G7FC-4GWC

Affected Products

Lara-Zeus Dynamic Dashboard

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47817.json · Exploit
• https://osv.dev/vulnerability/GHSA-c6cw-g7fc-4gwc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47817 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47817 · Vendor Advisory
• https://github.com/lara-zeus/dynamic-dashboard · Note
• https://github.com/lara-zeus/dynamic-dashboard/commit/adfb4b1cdfdaa01299631f0e569ce201a7cc545a · Note
• https://github.com/lara-zeus/dynamic-dashboard/security/advisories/GHSA-c6cw-g7fc-4gwc · Note
• https://github.com/lara-zeus/artemis/commit/4636f58628d20d3e78ea8514406bd7da94997f2c · Note
• https://github.com/lara-zeus/artemis/commit/3a3f9dd8a706af569c5581b20dcfeff91a43b9d9 · Note
• https://twitter.com/VulmonFeeds/status/1843457565805379700 · Twitter Post
• https://twitter.com/CVEnew/status/1843403550191219061 · Twitter Post
• https://t.me/cvedetector/7297 · Telegram Post