CVE-2024-25976

Medium

Description

When LDAP authentication is activated in the configuration it is possible to obtain reflected XSS execution by creating a custom URL that the victim only needs to open in order to execute arbitrary JavaScript code in the victim's browser. This is due to a fault in the file login.php where the content of "$_SERVER['PHP_SELF']" is reflected into the HTML of the website. Hence the attacker does not need a valid account in order to exploit this issue.

SeverityMedium

CVSS6.1

Exploit probability—

ProductHAWKI

PublishedMay 29, 2024

First seenMay 29, 2024

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Patches

github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1

Affected products

Product	Affected versions	Fixed in
Interaction Design Team at the University of Applied Sciences and Arts in Hildesheim/Germany HAWKI	versions before commit 146967f	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.