{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-25976", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "state": "PUBLISHED", "assignerShortName": "SEC-VLab", "dateReserved": "2024-02-13T09:28:28.810Z", "datePublished": "2024-05-29T12:22:46.526Z", "dateUpdated": "2025-03-17T20:39:15.968Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "HAWKI", "repo": "https://github.com/HAWK-Digital-Environments/HAWKI", "vendor": "Interaction Design Team at the University of Applied Sciences and Arts in Hildesheim/Germany", "versions": [{"status": "affected", "version": "versions before commit 146967f", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Florian Stuhlmann, Thorger Jansen (Office Bochum) | SEC Consult Vulnerability Lab"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "When LDAP authentication is activated in the configuration it is possible to obtain reflected XSS execution by creating a custom URL that the victim only needs to open in order to execute arbitrary JavaScript code in the victim's browser. This is due to a fault in the file login.php where the content of \"$_SERVER['PHP_SELF']\" is reflected into the HTML of the website. Hence the attacker does not need a valid account in order to exploit this issue."}], "value": "When LDAP authentication is activated in the configuration it is possible to obtain reflected XSS execution by creating a custom URL that the victim only needs to open in order to execute arbitrary JavaScript code in the victim's browser. This is due to a fault in the file login.php where the content of \"$_SERVER['PHP_SELF']\" is reflected into the HTML of the website. Hence the attacker does not need a valid account in order to exploit this issue."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2024-06-10T16:10:17.894Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://r.sec-consult.com/hawki"}, {"tags": ["patch"], "url": "https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1"}, {"url": "http://seclists.org/fulldisclosure/2024/May/34"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The vendor provides a patch which can be downloaded from <a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1\">https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1</a></p><br>"}], "value": "The vendor provides a patch which can be downloaded from https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1"}], "source": {"discovery": "UNKNOWN"}, "title": "Reflected Cross-Site-Scripting (XSS)", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-05-29T14:11:54.889111Z", "id": "CVE-2024-25976", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-17T20:39:15.968Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:52:06.357Z"}, "title": "CVE Program Container", "references": [{"tags": ["third-party-advisory", "x_transferred"], "url": "https://r.sec-consult.com/hawki"}, {"tags": ["patch", "x_transferred"], "url": "https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1"}, {"url": "http://seclists.org/fulldisclosure/2024/May/34", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://r.sec-consult.com/hawki", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1", "tags": ["patch", "x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2024/May/34", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:52:06.357Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-25976", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-29T14:11:54.889111Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-29T14:12:24.920Z"}}], "cna": {"title": "Reflected Cross-Site-Scripting (XSS)", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Florian Stuhlmann, Thorger Jansen (Office Bochum) | SEC Consult Vulnerability Lab"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"repo": "https://github.com/HAWK-Digital-Environments/HAWKI", "vendor": "Interaction Design Team at the University of Applied Sciences and Arts in Hildesheim/Germany", "product": "HAWKI", "versions": [{"status": "affected", "version": "versions before commit 146967f", "versionType": "custom"}], "defaultStatus": "affected"}], "solutions": [{"lang": "en", "value": "The vendor provides a patch which can be downloaded from https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1", "supportingMedia": [{"type": "text/html", "value": "<p>The vendor provides a patch which can be downloaded from <a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1\">https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1</a></p><br>", "base64": false}]}], "references": [{"url": "https://r.sec-consult.com/hawki", "tags": ["third-party-advisory"]}, {"url": "https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1", "tags": ["patch"]}, {"url": "http://seclists.org/fulldisclosure/2024/May/34"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "When LDAP authentication is activated in the configuration it is possible to obtain reflected XSS execution by creating a custom URL that the victim only needs to open in order to execute arbitrary JavaScript code in the victim's browser. This is due to a fault in the file login.php where the content of \"$_SERVER['PHP_SELF']\" is reflected into the HTML of the website. Hence the attacker does not need a valid account in order to exploit this issue.", "supportingMedia": [{"type": "text/html", "value": "When LDAP authentication is activated in the configuration it is possible to obtain reflected XSS execution by creating a custom URL that the victim only needs to open in order to execute arbitrary JavaScript code in the victim's browser. This is due to a fault in the file login.php where the content of \"$_SERVER['PHP_SELF']\" is reflected into the HTML of the website. Hence the attacker does not need a valid account in order to exploit this issue.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2024-06-10T16:10:17.894Z"}}}, "cveMetadata": {"cveId": "CVE-2024-25976", "state": "PUBLISHED", "dateUpdated": "2025-03-17T20:39:15.968Z", "dateReserved": "2024-02-13T09:28:28.810Z", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "datePublished": "2024-05-29T12:22:46.526Z", "assignerShortName": "SEC-VLab"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "When LDAP authentication is activated in the configuration it is possible to obtain reflected XSS execution by creating a custom URL that the victim only needs to open in order to execute arbitrary JavaScript code in the victim's browser. This is due to a fault in the file login.php where the content of \"$_SERVER['PHP_SELF']\" is reflected into the HTML of the website. Hence the attacker does not need a valid account in order to exploit this issue."}, {"lang": "es", "value": "Cuando la autenticaci\u00f3n LDAP est\u00e1 activada en la configuraci\u00f3n, es posible obtener la ejecuci\u00f3n XSS reflejado creando una URL personalizada que la v\u00edctima solo necesita abrir para ejecutar c\u00f3digo JavaScript arbitrario en el navegador de la v\u00edctima. Esto se debe a un fallo en el archivo login.php donde el contenido de \"$_SERVER['PHP_SELF']\" se refleja en el HTML del sitio web. Por lo tanto, el atacante no necesita una cuenta v\u00e1lida para aprovechar este problema."}], "id": "CVE-2024-25976", "lastModified": "2025-03-17T21:15:13.083", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-05-29T13:15:49.563", "references": [{"source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "url": "http://seclists.org/fulldisclosure/2024/May/34"}, {"source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "url": "https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1"}, {"source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "url": "https://r.sec-consult.com/hawki"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2024/May/34"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://r.sec-consult.com/hawki"}], "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "type": "Secondary"}]}

{}