PT-2025-2892 · Gestioip · Gestioip

Maximiliano Belino · Published 2025-01-14 · Updated 2025-06-06 · CVE-2024-50859

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GestioIP version 3.5.7

Description The issue concerns a Reflected XSS vulnerability in the ip import acl csv request. When a user uploads an improperly formatted file, the content may be reflected in the HTML response, allowing the attacker to execute malicious scripts or exfiltrate data.

Recommendations For GestioIP version 3.5.7, as a temporary workaround, consider disabling the ip import acl csv request until a patch is available. Restrict access to file uploads to minimize the risk of exploitation. Avoid using improperly formatted files in the affected request until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-50859

Affected Products

Gestioip

References · 14

• 🔥 https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50859 · Exploit
• 🔥 https://exploit-db.com/exploits/52202 · Exploit
• https://osv.dev/vulnerability/CVE-2024-50859 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-50859 · Security Note
• https://github.com/muebel/gestioip-docker-compose · Note
• https://t.me/cvedetector/15377 · Telegram Post
• https://t.me/cvenotify/107396 · Telegram Post
• https://twitter.com/syedaquib77/status/1911832494028325284 · Twitter Post
• https://t.me/cvenotify/124928 · Telegram Post
• https://twitter.com/CVEnew/status/1880988219850059908 · Twitter Post
• https://t.me/cvenotify/107551 · Telegram Post
• http://gestioip.net · Note
• https://t.me/cvenotify/107408 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1879313412917768641 · Twitter Post