GitHub Advisoryadvisory · Packagist

GHSA-3636-hx62-pv26 Zenario allows authenticated admin users to upload PDF files containing malicious code

LOW Published 2024-10-02 Modified 2024-10-02 Official page ↗
Aliases
CVE-2024-45960
Ecosystem
Packagist
Packages
tribalsystems/zenario
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-434, CWE-79
Reviewed
2024-10-02

Affected packages

• Packagist tribalsystems/zenario: <= 9.7.61188 (no fix yet)

Description

Zenario 9.7.61188 allows authenticated admin users to upload PDF files containing malicious code into the target system. If the PDF file is accessed through the website, it can trigger a Cross Site Scripting (XSS) attack.

Related

Alias · CVE (1)

  • CVE-2024-45960 Zenario 9.7.61188 allows authenticated admin users to upload PDF files containing malicious code into the target system. vulnerability

Weakness · CWE (2)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References