FKIE_CVE-2024-25976

Vulnerability from fkie_nvd - Published: 2024-05-29 13:15 - Updated: 2025-03-17 21:15
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
When LDAP authentication is activated in the configuration it is possible to obtain reflected XSS execution by creating a custom URL that the victim only needs to open in order to execute arbitrary JavaScript code in the victim's browser. This is due to a fault in the file login.php where the content of "$_SERVER['PHP_SELF']" is reflected into the HTML of the website. Hence the attacker does not need a valid account in order to exploit this issue.
References
551230f0-3615-47bd-b7cc-93e92e730bbfhttp://seclists.org/fulldisclosure/2024/May/34
551230f0-3615-47bd-b7cc-93e92e730bbfhttps://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1
551230f0-3615-47bd-b7cc-93e92e730bbfhttps://r.sec-consult.com/hawki
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2024/May/34
af854a3a-2127-422b-91ae-364da2661108https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1
af854a3a-2127-422b-91ae-364da2661108https://r.sec-consult.com/hawki
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "When LDAP authentication is activated in the configuration it is possible to obtain reflected XSS execution by creating a custom URL that the victim only needs to open in order to execute arbitrary JavaScript code in the victim\u0027s browser. This is due to a fault in the file login.php where the content of \"$_SERVER[\u0027PHP_SELF\u0027]\" is reflected into the HTML of the website. Hence the attacker does not need a valid account in order to exploit this issue."
    },
    {
      "lang": "es",
      "value": "Cuando la autenticaci\u00f3n LDAP est\u00e1 activada en la configuraci\u00f3n, es posible obtener la ejecuci\u00f3n XSS reflejado creando una URL personalizada que la v\u00edctima solo necesita abrir para ejecutar c\u00f3digo JavaScript arbitrario en el navegador de la v\u00edctima. Esto se debe a un fallo en el archivo login.php donde el contenido de \"$_SERVER[\u0027PHP_SELF\u0027]\" se refleja en el HTML del sitio web. Por lo tanto, el atacante no necesita una cuenta v\u00e1lida para aprovechar este problema."
    }
  ],
  "id": "CVE-2024-25976",
  "lastModified": "2025-03-17T21:15:13.083",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-05-29T13:15:49.563",
  "references": [
    {
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "url": "http://seclists.org/fulldisclosure/2024/May/34"
    },
    {
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "url": "https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1"
    },
    {
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "url": "https://r.sec-consult.com/hawki"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://seclists.org/fulldisclosure/2024/May/34"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://r.sec-consult.com/hawki"
    }
  ],
  "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.