PT-2025-22352 · Unknown · Konsola Proget
CVSS v4.0
2.4
Low
| Vector | AV:A/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Konsola Proget versions prior to 2.17.5
Description
The issue arises from input in the
activationMessage field not being sanitized correctly in Konsola Proget, allowing a high-privileged user to perform a Stored Cross-Site Scripting attack.Recommendations
For versions prior to 2.17.5, update to version 2.17.5 to resolve the issue. As a temporary workaround, consider restricting access to the
activationMessage field to minimize the risk of exploitation.Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Konsola Proget