CVE-2024-9291 - kalvinGit kvf-admin XML File cross site scripting

Back Back to CVE browser

MEDIUM

kalvinGit kvf-admin XML File cross site scripting

Published Sep 27, 2024

5.3

MEDIUM

CVSS 4.0

EPSS 0.39%

Description

A vulnerability classified as problematic has been found in kalvinGit kvf-admin up to f12a94dc1ebb7d1c51ee978a85e4c7ed75c620ff. Affected is an unknown function of the file /ueditor/upload?configPath=ueditor/config.json&action=uploadfile of the component XML File Handler. The manipulation of the argument upfile leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The GitHub repository of the project did not receive an update for more than two years.

Affected products

Vendor kalvinGit Product Kvf-Admin Default
n/a
- Version
  
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

kalvinGit

Kvf-Admin

n/a

Version	Status	Constraints
	affected	-

Vendor Kvf-Admin Project Product Kvf-Admin Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <commit_f12a94dc1ebb7d1c51ee978a85e4c7ed75c620ff

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Kvf-Admin Project

Kvf-Admin

n/a

Version	Status	Constraints
0	affected	<commit_f12a94dc1ebb7d1c51ee978a85e4c7ed75c620ff

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-49836
Advisory
https://github.com/daxiangya/kvf-admin/issues/1
issue-trackingExploitIssue Tracking
https://github.com/user-attachments/files/17058501/kvf-admin_xss.md
exploit
https://vuldb.com/?ctiid.278784
signaturepermissions-requiredPermissions RequiredThird Party AdvisoryVDB Entry
https://vuldb.com/?id.278784
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.411202
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-49836		Advisory
https://github.com/daxiangya/kvf-admin/issues/1		issue-trackingExploitIssue Tracking
https://github.com/user-attachments/files/17058501/kvf-admin_xss.md		exploit
https://vuldb.com/?ctiid.278784		signaturepermissions-requiredPermissions RequiredThird Party AdvisoryVDB Entry
https://vuldb.com/?id.278784		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.411202		third-party-advisoryThird Party AdvisoryVDB Entry