PT-2024-38093 · Unknown · Dingo Dlibra

Kacper Rybczyåski + 1 · Published 2024-11-14 · Updated 2024-11-15 · CVE-2024-7124

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/AU:Y/R:A/U:Green

Name of the Vulnerable Software and Affected Versions DInGO dLibra software versions 6.0 through 6.3.19

Description The issue is related to improper neutralization of input during web page generation, allowing a Reflected Cross-Site Scripting (XSS) attack. This occurs in the filter parameter of the "indexsearch" endpoint. An attacker could trick a user into using a crafted URL, causing a script to run in the user's browser.

Recommendations For versions 6.0 through 6.3.19, update to version 6.3.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the "indexsearch" endpoint or avoiding the use of the filter parameter until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-7124

Affected Products

Dingo Dlibra

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-7124 · Security Note
• https://dingo.psnc.pl/dlibra · Note
• https://twitter.com/CVEnew/status/1857080555491283138 · Twitter Post
• https://cert.pl/posts/2024/11/CVE-2024-7124 · Note
• https://t.me/cvedetector/10959 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1857105168908591419 · Twitter Post
• https://cert.pl/en/posts/2024/11/CVE-2024-7124 · Note