PT-2024-33165 · Domainmod · Domainmod

Leousumo · Published 2024-10-15 · Updated 2024-10-16 · CVE-2024-48624

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions DomainMOD versions prior to 4.12.0

Description A reflected Cross Site Scripting (XSS) issue is present in the segmentsedit.php file. The segid parameter in the GET request can be exploited to cause this issue.

Recommendations For versions prior to 4.12.0, update to version 4.12.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the segmentsedit.php file or avoiding the use of the segid parameter in the GET request until a patch is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-48624

Affected Products

Domainmod

References · 6

• https://github.com/domainmod/domainmod/issues/175 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-48624 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-48624 · Security Note
• https://twitter.com/VulmonFeeds/status/1846278451117887807 · Twitter Post
• https://twitter.com/CVEnew/status/1846214539467161650 · Twitter Post
• https://t.me/cvedetector/7935 · Telegram Post