PT-2024-36823 · Linkace · Linkace

Kwangyun · Published 2024-12-27 · Updated 2025-10-06 · CVE-2024-56508

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions LinkAce versions prior to 1.15.6

Description The issue occurs in the "Import Bookmarks" functionality, where malicious HTML files can be uploaded containing JavaScript payloads. These payloads execute when the uploaded links are accessed, leading to potential reflected or persistent XSS scenarios.

Recommendations For versions prior to 1.15.6, update to version 1.15.6 to resolve the issue. As a temporary workaround, consider disabling the "Import Bookmarks" functionality until a patch is available. Restrict access to uploaded links to minimize the risk of exploitation. Avoid using the "Import Bookmarks" feature with untrusted files until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-56508

GHSA-2WVV-4576-8862

Affected Products

Linkace

References · 12

• 🔥 https://github.com/Kovah/LinkAce/security/advisories/GHSA-2wvv-4576-8862 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56508.json · Exploit
• https://github.com/Kovah/LinkAce/commit/8cf3670d71a8629d33408da76f9d441a1aa933f6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-56508 · Security Note
• https://osv.dev/vulnerability/CVE-2024-56508 · Vendor Advisory
• https://t.me/cvedetector/13784 · Telegram Post
• https://twitter.com/cracbot/status/1874334808282902613 · Twitter Post
• https://t.me/cveNotify/137518 · Telegram Post
• https://twitter.com/CVEnew/status/1872889628916858912 · Twitter Post
• https://t.me/cvenotify/105653 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1872802806005989641 · Twitter Post
• https://t.me/latest_high_impact_cve/1718 · Telegram Post