PT-2024-5242 · Roundup · Roundup

Published 2024-06-21 · Updated 2024-08-02 · CVE-2024-39126

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Roundup versions prior to 2.4.0

Description: The issue is related to the lack of protection of the web page structure in the Roundup error tracking system. This allows a remote attacker to conduct cross-site scripting attacks by uploading specially crafted malicious files in PDF, XML, and SVG formats. The exploitation of this issue can lead to XSS via JavaScript in these documents.

Recommendations: For versions prior to 2.4.0, update to version 2.4.0 or later to resolve the issue. As a temporary workaround, consider restricting the upload of PDF, XML, and SVG files to minimize the risk of exploitation. Avoid using the affected file types in the system until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-05854

CVE-2024-39126

GHSA-X37X-QF4V-F54F

PYSEC-2024-65

Affected Products

Roundup

References · 16

• https://roundup-tracker.org/docs/security.html#cve-announcements · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05854 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-39126 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-39126 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-39126 · Security Note
• https://osv.dev/vulnerability/PYSEC-2024-65 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-39126 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x37x-qf4v-f54f · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-39126 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/roundup/PYSEC-2024-65.yaml · Note
• https://github.com/roundup-tracker/roundup · Note
• https://github.com/roundup-tracker/roundup/commit/860e3c8d07b05b77c6cdf5d0b6e7dbfe51b11631 · Note
• https://t.me/cvenotify/88642 · Telegram Post
• https://roundup-tracker.org · Note
• https://t.me/cvedetector/1124 · Telegram Post