CVE-2024-21516

{"id": "CVE-2024-21516", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.6}, {"type": "Secondary", "source": "report@snyk.io", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.6}]}, "published": "2024-06-22T05:15:10.967", "references": [{"url": "https://github.com/opencart/opencart/commit/c546199e8f100c1f3797a7a9d3cf4db1887399a2", "tags": ["Patch"], "source": "report@snyk.io"}, {"url": "https://security.snyk.io/vuln/SNYK-PHP-OPENCARTOPENCART-7266576", "tags": ["Exploit", "Patch", "Third Party Advisory"], "source": "report@snyk.io"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "report@snyk.io", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the directory parameter of admin common/filemanager.list route. An attacker could obtain a user's token by tricking the user to click on a maliciously crafted URL. The user is then prompted to login and redirected again upon authentication with the payload automatically executing. If the attacked user has admin privileges, this vulnerability could be used as the start of a chain of exploits like Zip Slip or arbitrary file write vulnerabilities in the admin functionality.\r\r**Notes:**\r\r1) This is only exploitable if the attacker knows the name or path of the admin directory. The name of the directory is \"admin\" by default but there is a pop-up in the dashboard warning users to rename it.\r\r2) The fix for this vulnerability is incomplete. The redirect is removed so that it is not possible for an attacker to control the redirect post admin login anymore, but it is still possible to exploit this issue in admin if the user is authenticated as an admin already."}, {"lang": "es", "value": "Esto afecta a las versiones del paquete opencart/opencart desde 4.0.0.0. Se identific\u00f3 un problema XSS reflejado en el par\u00e1metro de directorio de la ruta admin common/filemanager.list. Un atacante podr\u00eda obtener el token de un usuario enga\u00f1\u00e1ndolo para que haga clic en una URL creada con fines malintencionados. Luego se solicita al usuario que inicie sesi\u00f3n y se le redirige nuevamente tras la autenticaci\u00f3n y la carga \u00fatil se ejecuta autom\u00e1ticamente. Si el usuario atacado tiene privilegios de administrador, esta vulnerabilidad podr\u00eda usarse como el inicio de una cadena de exploits como Zip Slip o vulnerabilidades de escritura de archivos arbitrarios en la funcionalidad de administraci\u00f3n. **Notas:** 1) Esto solo se puede explotar si el atacante conoce el nombre o la ruta del directorio de administraci\u00f3n. El nombre del directorio es \"admin\" de forma predeterminada, pero hay una ventana emergente en el panel que advierte a los usuarios que le cambien el nombre. 2) La soluci\u00f3n para esta vulnerabilidad est\u00e1 incompleta. El redireccionamiento se elimina para que un atacante ya no pueda controlar el inicio de sesi\u00f3n del administrador posterior al redireccionamiento, pero a\u00fan es posible explotar este problema en el administrador si el usuario ya est\u00e1 autenticado como administrador."}], "lastModified": "2024-07-03T01:46:42.813", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opencart:opencart:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "60390C89-394D-4A4E-BD1C-C91F57B73CFD", "versionStartIncluding": "4.0.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "report@snyk.io"}