CVE-2024-7124 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

Improper Neutralization of Input During Web Page Generation vulnerability in DInGO dLibra software in the parameter 'filter' in the endpoint 'indexsearch' allows a Reflected Cross-Site Scripting (XSS). An attacker might trick somebody into using a crafted URL, which will cause a script to be run in user's browser. This issue affects DInGO dLibra software in versions from 6.0 before 6.3.20.

Reserved 2024-07-26 | Published 2024-11-14 | Updated 2024-11-14 | Assigner CERT-PL

MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/AU:Y/R:A/U:Green

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

Default status

unaffected

6.0 before 6.3.20

affected

Credits

Kacper Rybczyński finder

References

cert.pl/en/posts/2024/11/CVE-2024-7124/ third-party-advisory

cert.pl/posts/2024/11/CVE-2024-7124/ third-party-advisory

dingo.psnc.pl/dlibra/ product

cve.org (CVE-2024-7124)

nvd.nist.gov (CVE-2024-7124)

Download JSON

https://cve.threatint.com/CVE/CVE-2024-7124

Support options

Helpdesk Chat, Email, Knowledgebase

Subscribe to our newsletter to learn more about our work.