CVE-2024-7124

Improper Neutralization of Input During Web Page Generation vulnerability in DInGO dLibra software in the parameter 'filter' in the endpoint 'indexsearch' allows a Reflected Cross-Site Scripting (XSS). An attacker might trick somebody into using a crafted URL, which will cause a script to be run in user's browser. This issue affects DInGO dLibra software in versions from 6.0 before 6.3.20.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/en/posts/2024/11/CVE-2024-7124/
https://cert.pl/posts/2024/11/CVE-2024-7124/
https://dingo.psnc.pl/dlibra/

Configurations

No configuration.

History

15 Nov 2024, 13:58

Type	Values Removed	Values Added
Summary		(es) La vulnerabilidad de neutralización inadecuada de la entrada durante la generación de páginas web en el software DInGO dLibra en el parámetro 'filter' del endpoint 'indexsearch' permite un ataque de Cross Site Scripting (XSS) reflejado. Un atacante podría engañar a alguien para que use una URL manipulada, lo que hará que se ejecute un script en el navegador del usuario. Este problema afecta al software DInGO dLibra en las versiones 6.0 anteriores a la 6.3.20.

14 Nov 2024, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-11-14 15:15

Updated : 2024-11-15 13:58

NVD link : CVE-2024-7124

Mitre link : CVE-2024-7124

CVE.ORG link : CVE-2024-7124

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-7124", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "AUTOMATIC", "baseScore": 5.3, "automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:X/U:Green", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "GREEN", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "LOW", "vulnerableSystemIntegrity": "LOW", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "LOW", "vulnerableSystemAvailability": "LOW", "subsequentSystemConfidentiality": "LOW", "vulnerableSystemConfidentiality": "LOW", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-11-14T15:15:09.177", "references": [{"url": "https://cert.pl/en/posts/2024/11/CVE-2024-7124/", "source": "cvd@cert.pl"}, {"url": "https://cert.pl/posts/2024/11/CVE-2024-7124/", "source": "cvd@cert.pl"}, {"url": "https://dingo.psnc.pl/dlibra/", "source": "cvd@cert.pl"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation vulnerability in DInGO dLibra software\u00a0in the parameter 'filter' in the endpoint 'indexsearch' allows a Reflected Cross-Site Scripting (XSS). An attacker might trick somebody into using a crafted URL, which will cause a script to be run in user's browser. This issue affects DInGO dLibra software in versions from 6.0 before 6.3.20."}, {"lang": "es", "value": "La vulnerabilidad de neutralizaci\u00f3n inadecuada de la entrada durante la generaci\u00f3n de p\u00e1ginas web en el software DInGO dLibra en el par\u00e1metro 'filter' del endpoint 'indexsearch' permite un ataque de Cross Site Scripting (XSS) reflejado. Un atacante podr\u00eda enga\u00f1ar a alguien para que use una URL manipulada, lo que har\u00e1 que se ejecute un script en el navegador del usuario. Este problema afecta al software DInGO dLibra en las versiones 6.0 anteriores a la 6.3.20."}], "lastModified": "2024-11-15T13:58:08.913", "sourceIdentifier": "cvd@cert.pl"}