Farouk
·
Published
2024-06-30
·
Updated
2024-07-01
·
CVE-2024-6415
3.3
Low
| Base vector | Vector | AV:N/AC:L/Au:M/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions:
Ingenico Estate Manager version 2023
Description:
A problematic vulnerability was found in the New Widget Handler component, affecting an unknown functionality of the file /emgui/rest/preferences/PREF HOME PAGE/sponsor/3/. The manipulation of the `URL` argument leads to cross-site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Recommendations:
For Ingenico Estate Manager version 2023, as a temporary workaround, consider restricting access to the `/emgui/rest/preferences/PREF HOME PAGE/sponsor/3/` endpoint until a patch is available. Avoid using the `URL` argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
XSS