1337_Wannabe
+1
·
Published
2025-01-25
·
Updated
2025-01-25
·
CVE-2024-10552
6.4
Medium
| Base vector | Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
Flexmls® IDX Plugin versions up to, and including, 3.14.26
Description:
The issue is related to Stored Cross-Site Scripting via the `api key` and `api secret` parameters due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Recommendations:
For versions up to, and including, 3.14.26, update to a version later than 3.14.26 to fully resolve the issue, as version 3.14.25 only partially patches the vulnerability.
As a temporary workaround, consider restricting access to the `api key` and `api secret` parameters to minimize the risk of exploitation.
Fix
XSS