Products
UNKNOWN
Source
551230f0-3615-47bd-b7cc-93e92e730bbf
Tags
CVE-2024-25976 details
Published : May 29, 2024, 1:15 p.m.
Last Modified : May 29, 2024, 3:18 p.m.
Last Modified : May 29, 2024, 3:18 p.m.
Description
When LDAP authentication is activated in the configuration it is possible to obtain reflected XSS execution by creating a custom URL that the victim only needs to open in order to execute arbitrary JavaScript code in the victim's browser. This is due to a fault in the file login.php where the content of "$_SERVER['PHP_SELF']" is reflected into the HTML of the website. Hence the attacker does not need a valid account in order to exploit this issue.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|
References
| URL | Source |
|---|---|
| https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1 | 551230f0-3615-47bd-b7cc-93e92e730bbf |
| https://r.sec-consult.com/hawki | 551230f0-3615-47bd-b7cc-93e92e730bbf |
This website uses the NVD API, but is not approved or certified by it.