PT-2024-35776 · Taiga · Taiga

Avihay Eldad + 2 · Published 2024-11-25 · Updated 2024-11-27 · CVE-2024-53556

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Taiga version 6.8.1

Description The issue allows attackers to redirect users to arbitrary websites by appending a crafted link to the /login?next= parameter in the login page URL. This can potentially lead to unauthorized access.

Recommendations For Taiga version 6.8.1, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the /login endpoint or validating the next parameter to prevent redirects to unauthorized websites.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-53556

Affected Products

Taiga

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-53556 · Security Note
• https://twitter.com/oktsec/status/1861283152372600871 · Twitter Post
• https://gist.githubusercontent.com/Tommywarren/b42479a048aa8ef11a63a76d14403443/raw/e24c1003accf8daf2e840b7c67d2f0ab30bdd3e6/CVE-2024-53556 · Note
• https://drive.google.com/file/d/1CIr8oHSF4JaqOn51wIhyZyvsCtlX0Q_e/view?usp=drive_link · Note
• https://twitter.com/CVEnew/status/1861150492400984234 · Twitter Post