CVE-2024-6939

A vulnerability was found in Xinhu RockOA 2.6.3 and classified as problematic. Affected by this issue is the function okla of the file /webmain/public/upload/tpl_upload.html. The manipulation of the argument callback leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-271994 is the identifier assigned to this vulnerability.
References
Link Resource
https://github.com/rainrocka/xinhu/issues/7 Exploit Third Party Advisory
https://vuldb.com/?ctiid.271994 Permissions Required
https://vuldb.com/?id.271994 Third Party Advisory
https://vuldb.com/?submit.372744 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:xinhu:rockoa:2.6.3:*:*:*:*:*:*:*

History

20 Sep 2024, 22:55

Type Values Removed Values Added
CVSS v2 : 4.0
v3 : 3.5
v2 : 4.0
v3 : 6.1
References () https://github.com/rainrocka/xinhu/issues/7 - () https://github.com/rainrocka/xinhu/issues/7 - Exploit, Third Party Advisory
References () https://vuldb.com/?ctiid.271994 - () https://vuldb.com/?ctiid.271994 - Permissions Required
References () https://vuldb.com/?id.271994 - () https://vuldb.com/?id.271994 - Third Party Advisory
References () https://vuldb.com/?submit.372744 - () https://vuldb.com/?submit.372744 - Third Party Advisory
CPE cpe:2.3:a:xinhu:rockoa:2.6.3:*:*:*:*:*:*:*
First Time Xinhu rockoa
Xinhu

22 Jul 2024, 13:00

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad fue encontrada en Xinhu RockOA 2.6.3 y clasificada como problemática. La función okla del archivo /webmain/public/upload/tpl_upload.html es afectada por esta vulnerabilidad. La manipulación del argumento callback conduce a Cross Site Scripting. El ataque puede lanzarse de forma remota. El exploit ha sido divulgado al público y puede utilizarse. VDB-271994 es el identificador asignado a esta vulnerabilidad.

21 Jul 2024, 05:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-07-21 05:15

Updated : 2024-09-20 22:55


NVD link : CVE-2024-6939

Mitre link : CVE-2024-6939

CVE.ORG link : CVE-2024-6939


JSON object : View

Products Affected

xinhu

  • rockoa
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')