Description

When LDAP authentication is activated in the configuration it is possible to obtain reflected XSS execution by creating a custom URL that the victim only needs to open in order to execute arbitrary JavaScript code in the victim's browser. This is due to a fault in the file login.php where the content of "$_SERVER['PHP_SELF']" is reflected into the HTML of the website. Hence the attacker does not need a valid account in order to exploit this issue.

INFO

Published Date :

2024-05-29T12:22:46.526Z

Last Modified :

2025-03-17T20:39:15.968Z

Source :

SEC-VLab
AFFECTED PRODUCTS

The following products are affected by CVE-2024-25976 vulnerability.

No data.

REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-25976.

URL Resource
http://seclists.org/fulldisclosure/2024/May/34 cve-icon cve-icon
https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1 cve-icon cve-icon
https://r.sec-consult.com/hawki cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact