PT-2024-39249 · Unknown · Opentibiabr Myaac

Rafael Cintra Lopes · Published 2024-09-13 · Updated 2024-09-19 · CVE-2024-8783

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: OpenTibiaBR MyAAC versions up to 0.8.16

Description: A problematic vulnerability has been found in OpenTibiaBR MyAAC, affecting an unknown function of the file system/pages/forum/new post.php of the component Post Reply Handler. The manipulation of the post topic argument leads to cross-site scripting. It is possible to launch the attack remotely.

Recommendations: For versions up to 0.8.16, apply a patch to fix this issue, specifically the patch identified as bf6ae3df0d32fa22552bb44ca4f8489a6e78cc1c. As a temporary workaround, consider restricting the use of the post topic argument in the new post.php file until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-8783

Affected Products

Opentibiabr Myaac

References · 12

• 🔥 https://github.com/opentibiabr/myaac/issues/121 · Exploit
• https://github.com/opentibiabr/myaac/pull/122 · Patch
• https://github.com/opentibiabr/myaac/pull/122/commits/bf6ae3df0d32fa22552bb44ca4f8489a6e78cc1c · Patch
• https://osv.dev/vulnerability/CVE-2024-8783 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8783 · Security Note
• https://twitter.com/oktsec/status/1834626685502648432 · Twitter Post
• https://vuldb.com/?submit.406368 · Note
• https://twitter.com/CVEnew/status/1834664180411932843 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1834693359543136744 · Twitter Post
• https://vuldb.com/?id.277434 · Note
• https://t.me/cvedetector/5649 · Telegram Post
• https://vuldb.com/?ctiid.277434 · Note