PT-2024-38033 · Unknown · Smart Doctor

Selman Konakci · Published 2024-11-21 · Updated 2024-11-21 · CVE-2024-7016

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Smart Doctor versions through 21.11.2024

Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks. The vendor was contacted about this disclosure but did not respond.

Recommendations For versions through 21.11.2024, as a temporary workaround, consider restricting user input in web page generation to minimize the risk of Stored XSS attacks. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-7016

Affected Products

Smart Doctor

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-7016 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7016 · Vendor Advisory
• https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-1865 · Note
• https://usom.gov.tr/bildirim/tr-24-1865 · Note
• https://twitter.com/CVEnew/status/1859601778662310012 · Twitter Post