PT-2024-39482 · Unknown · Clibo Manager

David Padilla Alvarado · Published 2024-09-26 · Updated 2024-10-02 · CVE-2024-9198

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Clibo Manager version 1.1.9.1

Description The issue allows an attacker to execute a stored Cross-Site Scripting (XSS) attack by uploading a malicious .svg image in the Profile > Profile picture section. This could potentially affect a significant number of devices, although the exact number is not specified. There is no information provided about real-world incidents where this issue was exploited.

Recommendations For Clibo Manager version 1.1.9.1, consider disabling the ability to upload .svg images in the Profile > Profile picture section until a patch is available. Restrict access to the Profile picture upload feature to minimize the risk of exploitation. Avoid using the Profile picture upload feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-9198

Affected Products

Clibo Manager

References · 8

• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-clibo-manager · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-9198 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9198 · Security Note
• https://twitter.com/VulmonFeeds/status/1839294239173185649 · Twitter Post
• https://t.me/latest_high_impact_cve/1221 · Telegram Post
• https://t.me/cvedetector/6398 · Telegram Post
• https://twitter.com/CVEnew/status/1839247964226589082 · Twitter Post
• https://twitter.com/cracbot/status/1840995119266480545 · Twitter Post