PT-2024-9219 · Osmedeus+1 · Osmedeus+1
Published
2024-10-31
·
Updated
2024-11-22
·
CVE-2024-51735
CVSS v4.0
9.3
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N |
Name of the Vulnerable Software and Affected Versions:
Osmedeus (affected versions not specified)
Description:
The issue is related to a Cross-site Scripting (XSS) vulnerability in the Osmedeus web server when viewing results from the workflow. This allows commands to be executed on the server. The vulnerability occurs because the file contents are not properly filtered, leading to XSS. The default report is based on the
general-template.md template, and the contents of the files are read and used to generate the report. The issue starts with processing the <content> tags, and XSS occurs when the extendTag function is called. A payload can be crafted to execute commands on the server, such as writing to a file.Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
XSS
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Osmedeus
Suse