A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.3. Affected is an unknown function of the file /admin/article.php?action=upload_cover of the component Cover Upload Handler. The manipulation of the argument image leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
References
| Link | Resource |
|---|---|
| https://github.com/emlog/emlog/issues/312 | Exploit Issue Tracking |
| https://github.com/emlog/emlog/issues/312#issue-2758546837 | Exploit Issue Tracking |
| https://vuldb.com/?ctiid.290214 | Permissions Required VDB Entry |
| https://vuldb.com/?id.290214 | Permissions Required VDB Entry |
| https://vuldb.com/?submit.468753 | Third Party Advisory VDB Entry |
Configurations
History
10 Jan 2025, 21:34
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/emlog/emlog/issues/312 - Exploit, Issue Tracking | |
| References | () https://vuldb.com/?ctiid.290214 - Permissions Required, VDB Entry | |
| References | () https://github.com/emlog/emlog/issues/312#issue-2758546837 - Exploit, Issue Tracking | |
| References | () https://vuldb.com/?id.290214 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?submit.468753 - Third Party Advisory, VDB Entry | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| First Time |
Emlog emlog
Emlog |
|
| CWE | ||
| CPE | cpe:2.3:a:emlog:emlog:*:*:*:*:pro:*:*:* |
05 Jan 2025, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-01-05 12:15
Updated : 2025-01-10 21:34
NVD link : CVE-2024-13140
Mitre link : CVE-2024-13140
JSON object : View
Products Affected
emlog
- emlog
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')