PT-2024-7359 · Cfx.Re · Cfx.Re Fxserver

Published 2024-06-04 · Updated 2025-01-16 · CVE-2024-46310

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Cfx.re FXServer versions v9601 and earlier wpDiscuz (affected versions not specified)

Description: The issue is related to incorrect access control and the failure to neutralize script-related HTML tags on a web page. This can allow a remote attacker to compromise data integrity. Specifically, in Cfx.re FXServer, unauthenticated users can modify and read arbitrary user data via an exposed API endpoint.

Recommendations: For Cfx.re FXServer versions v9601 and earlier, restrict access to the exposed API endpoint to prevent unauthenticated users from modifying and reading user data. For wpDiscuz, as a temporary workaround, consider disabling the processing of script-related HTML tags until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability in wpDiscuz.

Exploit

Fix

XSS

Improper Preservation of Permissions

Weakness Enumeration

CWE-80

CWE-281

Related Identifiers

BDU:2024-08722

CVE-2024-46310

Affected Products

Cfx.Re Fxserver

References · 9

• 🔥 https://github.com/PRX5Y/CVE-2024-46310 · Exploit
• https://bdu.fstec.ru/vul/2024-08722 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-46310 · Security Note
• http://cfxre.com · Note
• https://patchstack.com/database/vulnerability/wpdiscuz/wordpress-wpdiscuz-plugin-7-6-10-content-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1878885811313090717 · Twitter Post
• https://t.me/cvedetector/15168 · Telegram Post
• https://twitter.com/gothburz/status/1879222056140583323 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1843151088486097371 · Twitter Post