PT-2025-5762 · Skybox · Skybox Change Manager

Dan Dorego · Published 2025-02-05 · Updated 2025-02-05 · CVE-2024-54853

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Skybox Change Manager versions 13.2.170 and earlier

Description A Stored Cross-Site Scripting issue was identified that allows remote authenticated users to store malicious payloads in an affected field, which would then execute in an unsuspecting victim's browser.

Recommendations For Skybox Change Manager versions 13.2.170 and earlier, consider restricting access to the affected field to minimize the risk of exploitation until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-54853

Affected Products

Skybox Change Manager

References · 3

• 🔥 https://github.com/KoratSec/CVEs/blob/main/CVE-2024-54853.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-54853 · Security Note
• https://twitter.com/CVEnew/status/1887257446743151051 · Twitter Post