PT-2024-36822 · Linkace · Linkace

Kwangyun · Published 2024-12-27 · Updated 2025-10-06 · CVE-2024-56507

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LinkAce versions prior to 1.15.6

Description A reflected cross-site scripting (XSS) issue exists in the "URL" field of the "Edit Link" module, where user input is not properly sanitized or encoded before being reflected in the HTML response. This allows attackers to inject and execute arbitrary JavaScript in the context of the victim’s browser, leading to potential session hijacking, data theft, and unauthorized actions.

Recommendations For versions prior to 1.15.6, update to version 1.15.6 to resolve the issue. As a temporary workaround, consider restricting user input in the "URL" field of the "Edit Link" module to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-56507

GHSA-CJCG-WJ4P-PGC5

Affected Products

Linkace

References · 10

• 🔥 https://github.com/Kovah/LinkAce/security/advisories/GHSA-cjcg-wj4p-pgc5 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56507.json · Exploit
• https://github.com/Kovah/LinkAce/commit/c7cd6a323a03ccd89c7f905f7d9f2afc265b7b67 · Patch
• https://osv.dev/vulnerability/CVE-2024-56507 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56507 · Security Note
• https://t.me/cvenotify/105652 · Telegram Post
• https://t.me/cveNotify/137517 · Telegram Post
• https://twitter.com/CVEnew/status/1872889629910941954 · Twitter Post
• https://t.me/cvedetector/13783 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1872797685863833886 · Twitter Post