PT-2024-25920 · Unknown · Rukovoditel
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Rukovoditel versions prior to 3.5.3
Description
The issue allows for XSS via the
user photo parameter to My Page. This can potentially lead to malicious script execution.Recommendations
For versions prior to 3.5.3, update to version 3.5.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the
user photo parameter in the My Page section until the update is applied.Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Rukovoditel