Today > | 4 Medium | 2 Low vulnerabilities   -   You can now download lists of IOCs here!

CVE-2024-25976

May 29, 2024, 3:18 p.m.

Tags

CWE-79
2024-05-29
CVE-2024-25976
551230f0-3615-47bd-b7cc-93e92e730bbf

Product(s) Impacted

UNKNOWN

Description

When LDAP authentication is activated in the configuration it is possible to obtain reflected XSS execution by creating a custom URL that the victim only needs to open in order to execute arbitrary JavaScript code in the victim's browser. This is due to a fault in the file login.php where the content of "$_SERVER['PHP_SELF']" is reflected into the HTML of the website. Hence the attacker does not need a valid account in order to exploit this issue.

Weaknesses

Date

Published: May 29, 2024, 1:15 p.m.

Last Modified: May 29, 2024, 3:18 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

551230f0-3615-47bd-b7cc-93e92e730bbf

References

https://github.com/ 551230f0-3615-47bd-b7cc-93e92e730bbf
https://r.sec-consult.com/ 551230f0-3615-47bd-b7cc-93e92e730bbf