PT-2024-39072 · Wavelog · Wavelog

Piglet · Published 2024-09-06 · Updated 2025-06-04 · CVE-2024-8521

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Wavelog versions 1.8.0 and earlier

Description A problem was found in the function index of the file /qso of the component Live QSO. The manipulation of the manual argument leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations For versions 1.8.0 and earlier, upgrade to version 1.8.1 to address this issue. As a temporary workaround, consider restricting access to the /qso API endpoint of the Live QSO component until the issue is resolved. Avoid using the manual argument in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-8521

Affected Products

Wavelog

References · 14

• 🔥 https://github.com/GithubUser843205/CVEs/tree/main/CVE-2024-8521 · Exploit
• https://github.com/wavelog/wavelog/commit/b31002cec6b71ab5f738881806bb546430ec692e · Patch
• https://github.com/wavelog/wavelog/releases/tag/1.8.1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-8521 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8521 · Vendor Advisory
• https://github.com/wavelog/wavelog/pull/744 · Note
• https://t.me/cvedetector/5014 · Telegram Post
• https://twitter.com/oktsec/status/1832089938499612824 · Twitter Post
• https://vuldb.com/?ctiid.276726 · Note
• https://vuldb.com/?submit.399819 · Note
• https://t.me/cvenotify/124623 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1832370735324508666 · Twitter Post
• https://vuldb.com/?id.276726 · Note
• https://twitter.com/CVEnew/status/1832332460744437978 · Twitter Post