PT-2024-35079 · Unknown · Password Pusher

Igniter07 · Published 2024-11-07 · Updated 2024-11-08 · CVE-2024-51989

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Password Pusher versions v1.41.1 through v1.48.0

Description A cross-site scripting (XSS) vulnerability was identified in the Password Pusher application. The issue arises from an un-sanitized parameter which could allow attackers to inject malicious JavaScript into the application. Users who self-host and have the login system enabled are affected. Exploitation of this vulnerability could expose user data, access to user sessions, or take unintended actions on behalf of users. To exploit this vulnerability, an attacker would need to convince a user to click a malicious account confirmation link.

Recommendations Update to version v1.48.1 or later where input sanitization has been applied to the account confirmation process. If updating is not immediately possible, consider restricting access to the application until the update can be applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-51989

GHSA-5CHG-CQ29-GFQF

Affected Products

Password Pusher

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51989.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-51989 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-51989 · Security Note
• https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-5chg-cq29-gfqf · Note
• https://twitter.com/CVEnew/status/1854589865884873085 · Twitter Post
• https://twitter.com/pwpush/status/1854527980720075168 · Twitter Post
• https://t.me/cvedetector/10114 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1854644735337541899 · Twitter Post