PT-2025-2755 · Unknown · Observium Ce

Icewall + 2 · Published 2025-01-15 · Updated 2025-01-15 · CVE-2024-47002

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Observium CE version 24.4.13528

Description: A html code injection vulnerability exists in the vlan management part of Observium CE. This issue can be exploited by an attacker sending a specially crafted HTTP request, potentially leading to the execution of arbitrary html code. For a successful attack, an authenticated user would need to click on a malicious link provided by the attacker.

Recommendations: For Observium CE version 24.4.13528, consider disabling the vlan management feature until a patch is available to prevent potential html code injection attacks. Restrict access to the vlan management module to minimize the risk of exploitation. Avoid using the vlan management feature in Observium CE until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-47002

Affected Products

Observium Ce

References · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2024-2091 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-47002 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47002 · Vendor Advisory
• https://twitter.com/CveFindCom/status/1879552593027805328 · Twitter Post
• https://twitter.com/CVEnew/status/1879657534178386349 · Twitter Post
• https://t.me/cvedetector/15464 · Telegram Post