PT-2024-38649 · Unknown · Veribase Order

Tunahan Tekeoğlu · Published 2024-09-17 · Updated 2024-09-20 · CVE-2024-7873

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Veribase Order versions prior to 4.010.3

Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), which allows Stored XSS, Cross-Site Scripting, exploitation of Script-Based APIs, and XSS Through HTTP Headers. This is due to improper encoding or escaping of output and improper neutralization of script in attributes in a web page.

Recommendations For versions prior to 4.010.3, update to version 4.010.3 or later to resolve the issue. As a temporary workaround, consider restricting access to script-based APIs and HTTP headers to minimize the risk of exploitation. Additionally, ensure proper input validation and output encoding to prevent cross-site scripting attacks.

Fix

Improper Encoding or Escaping of Output

XSS

Weakness Enumeration

CWE-116

CWE-79

Related Identifiers

CVE-2024-7873

Affected Products

Veribase Order

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-7873 · Security Note
• https://t.me/cvenotify/94906 · Telegram Post
• https://t.me/latest_high_impact_cve/1161 · Telegram Post
• https://twitter.com/CveFindCom/status/1836027595734806708 · Twitter Post
• https://usom.gov.tr/bildirim/tr-24-1485 · Note
• https://twitter.com/CVEnew/status/1836027427622924309 · Twitter Post
• https://t.me/cvedetector/5808 · Telegram Post
• https://twitter.com/Vu1nAlert/status/1836030781350728178 · Twitter Post