PT-2025-1307

CVE-2024-55416

Published

2025-01-30

Updated

2025-02-06

Description by

CVSS 2.0

9.0

High

MetricsAV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions DevDojo Voyager versions 1.8.0 and earlier

Description The issue allows for reflected XSS via the "/admin/compass" API endpoint. By manipulating an authenticated user to click on a link, arbitrary JavaScript code can be executed.

Recommendations DevDojo Voyager versions 1.8.0 and earlier: Update to a version later than 1.8.0 to resolve the issue. As a temporary workaround, consider restricting access to the "/admin/compass" API endpoint until a patch is available.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

CWE-23: Relative Path Traversal

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers