PT-2024-31: Reflected Cross-Site Scripting (Reflected XSS) in Passwork
Vendor: Passwork
Vulnerable product: Passwork
Vulnerable version: 6.4.0
Vulnerability type:
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Identifier (ID):
• BDU:2024-08016
Vulnerability vector:
• Base vulnerability score (CVSSv3.1): CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
• Severity (CVSSv3.1): 7.4(high)
• Base vulnerability score (CVSSv4.0): CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
• Severity (CVSSv4.0): 6.1(medium)
Description:
The vulnerability was identified in Passwork version 6.4.0.
The application does not process the data received from the user, which is necessary for safety use during web page formation. An attacker can inject a malicious script into the request parameters and conduct social engineering attack on a user.
Vulnerability status: Confirmed by vendor
Date of vulnerability remediation: 09.10.2024
Recommendations:
• Update to version 6.4.3 or higher
Additional information: Oleg Surnin (Positive Technologies)