Positive Tech ‘Working’ the CVEs

The most interesting vulnerabilities

🐛 CVE-2024-37896 discovered in Gin-vue-admin before 2.6.6 leads to SQL Injection.  The problem was that an attacker could inject arbitrary SQL code into the order parameter of an http request when accessing the /api/sysExportTemplate/exportExcel endpoint.  The fix added checks to ensure that the value of the order parameter is correct before using it in an SQL query.

🐛 CVE-2024-38356 discovered in TinyMCE before 5.11.0 leads to Cross-Site Scripting (XSS).  The issue was the ability of an attacker to inject malicious code into specially crafted HTML attributes that could be executed when content was extracted from the editor.  The fix added the isValidContent() function, which is used to validate the content variable containing user data using the nonEditableRegExps regular expression array.

🐛 CVE-2024-36116 discovered in Reposilite before 3.3.0 leads to Path Traversal.  The problem was the ability to inject a payload into the file name inside the loaded Javadoc archive, which is then fed into the Paths.get() function without normalization, allowing the creation of an arbitrary file.  The fix changed the algorithm for processing downloaded archives by converting the names of files inside the archive into paths, which subsequently undergo a membership check relative to the javadocUnpackPath parent directory.

🐛 CVE-2024-37902 discovered in DeepJavaLibrary(DJL) 0.1.0 to 0.27.0 leads to Path Traversal.  The vulnerability is due to the ability of an attacker to create an archive containing files with names containing file system paths, download it and overwrite arbitrary files.  The fix added the removeLeadingFileSeparator method, which, using File.separatorChar, removes separator characters from the names of files located in downloaded archives.

🐛 CVE-2024-4358 discovered in Progress Telerik Report Server before 2024 Q1 (10.0.24.305) leads to Authentication Bypass.  The issue was the ability of an unauthenticated attacker to gain access to limited functionality of the Telerik Report Server.  Information about the vulnerability, affected versions, update recommendations and possible preventative measures can be found in Security Advisory