PT-2024-4338 · Labvantage · Labvantage Lims

Farouk · Published 2024-06-20 · Updated 2024-08-19 · CVE-2024-6181

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LabVantage LIMS version 2017

Description A vulnerability in LabVantage LIMS allows for cross-site scripting (XSS) attacks. The issue is related to the manipulation of the height and width arguments in the file /labvantage/rc?command=file&file=WEB-CORE/elements/files/filesembedded.jsp&size=32. This can be exploited remotely. The vendor was contacted about this issue but did not respond.

Recommendations For LabVantage LIMS version 2017, as a temporary workaround, consider restricting access to the /labvantage/rc API endpoint or disabling the manipulation of the height and width parameters in the file filesembedded.jsp until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-04827

CVE-2024-6181

Affected Products

Labvantage Lims

References · 10

• 🔥 https://gentle-khaan-c53.notion.site/Reflected-XSS-in-Labvantage-LIMS-9531d77dce984d4da2ddcab863962e9c?pvs=4 · Exploit
• https://bdu.fstec.ru/vul/2024-04827 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-6181 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6181 · Vendor Advisory
• https://vuldb.com/?id.269152 · Note
• https://vuldb.com/?submit.353709 · Note
• https://vuldb.com/?ctiid.269152 · Note
• https://gentle-khaan-c53.notion.site/Reflected-XSS-in-Labvantage-LIMS-9531d77dce984d4da2ddcab863962e9c · Note
• https://twitter.com/linuxpatch/status/1803761246165954613 · Twitter Post
• https://twitter.com/CVEnew/status/1803772965445910826 · Twitter Post