PT-2024-35891 · Yahoo · Max Engel Yahoo! Webplayer

Soprobro · Published 2024-12-02 · Updated 2024-12-02 · CVE-2024-53779

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Max Engel Yahoo! WebPlayer versions n/a through 2.0.6

Description The issue is a Cross-Site Request Forgery (CSRF) vulnerability that allows Stored XSS. This means an attacker can perform actions on behalf of a user without their knowledge or consent, and also store malicious scripts that can be executed by the application.

Recommendations For Max Engel Yahoo! WebPlayer versions n/a through 2.0.6, update to a version later than 2.0.6 to resolve the issue. As a temporary workaround, consider restricting access to sensitive functions to minimize the risk of exploitation. Avoid using the application until the issue is resolved. At the moment, there is no information about additional mitigation measures.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-53779

Affected Products

Max Engel Yahoo! Webplayer

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-53779 · Security Note
• https://twitter.com/CVEnew/status/1863593006047396062 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/yahoo-media-player/vulnerability/wordpress-yahoo-webplayer-plugin-2-0-6-csrf-to-stored-xss-vulnerability?_s_id=cve · Note
• https://t.me/cvedetector/11773 · Telegram Post
• https://patchstack.com/database/wordpress/plugin/yahoo-media-player/vulnerability/wordpress-yahoo-webplayer-plugin-2-0-6-csrf-to-stored-xss-vulnerability?_s_id=cve · Note