Multiple vulnerabilities in WinNMP from Wtriple
Posted date 27/05/2024
Importance
3 - Medium
Affected Resources
WinNMP 19.02.
Description
INCIBE has coordinated the publication of 2 vulnerabilities affecting Wtriple WinNMP 19.02 which have been discovered by Rafael Pedrero.
These vulnerabilities have been assigned the following codes, CVSS v3.1 base score, CVSS vector and CWE vulnerability type for each vulnerability:
- CVE-2024-5405 y CVE-2024-5406: 6.3 | CVSS:3.1:AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L | CWE-79
Solution
There is no reported solution at this time.
Detail
2 vulnerabilities have been discovered in WinNMP 19.02 consisting of an XSS attack via:
- CVE-2024-5405: /tools/redis.php page in the k, hash, key and p parameters. This vulnerability could allow a remote user to submit a specially crafted JavaScript payload for an authenticated user to retrieve their session details.
- CVE-2024-5406: index page in from, subject, text and hash parameters. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their session details.
Etiquetas
