Medium – 6.4
CVSS:4.0/ AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

PT-2024-44: Cross-Site Scripting (XSS) in Antiphish

Error type:

  • CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Vulnerability vector:

  • Base vulnerability score (CVSSv3.1): CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
  • Severity (CVSSv3.1): 7.1 (high)
  • Base vulnerability score (CVSSv4.0): CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
  • Severity (CVSSv4.0): 6.4 (medium)

Description:

The vulnerability was identified in Antiphish in versions before 2.4.12-cu9.

The discovered vulnerability allows an attacker to inject code into a page processed by a user's browser, including JavaScript scripts.

Vulnerability status: Confirmed by vendor

Date of vulnerability remediation: 12.12.2023

Recommendations:

  • Update to version 2.4.12-cu9 or higher

Researcher: Alexander Minin (Positive Technologies)

Identifiers:

BDU:2024-06212

Vendor:

LLC "Antiphishing"

Vulnerable product:

Antiphish

Vulnerable versions:

< 2.4.12-cu9