Multiple vulnerabilities in WPN-XM Serverstack
Posted date 03/11/2023
Identificador
INCIBE-2023-0478
Importance
4 - High
Affected Resources
WPN-XM Serverstack, version 0.8.6.
Description
INCIBE has coordinated the publication of 2 vulnerabilities that affect WPN-XM Serverstack 0.8.6, which have been discovered by Rafael Pedrero.
These vulnerabilities have been assigned the following code, CVSS v3.1 base score, CVSS vector string, and CWE vulnerability type:
- CVE-2023-4591: CVSS v3.1: 7.5 | CVSS: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | CWE-829.
- CVE-2023-4592: CVSS v3.1: 6.1 | CVSS: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | CWE-79.
Solution
There is no reported solution at this time.
Detail
- CVE-2023-4591: a local file inclusion vulnerability has been found in WPN-XM Serverstack affecting version 0.8.6, which would allow an unauthenticated user to perform a local file inclusion (LFI) via the /tools/webinterface/index.php?page parameter by sending a GET request. This vulnerability could lead to the loading of a PHP file on the server, leading to a critical webshell exploit.
- CVE-2023-4592: a Cross-Site Scripting vulnerability has been detected in WPN-XM Serverstack affecting version 0.8.6. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload through the /tools/webinterface/index.php parameter and retrieve the cookie session details of an authenticated user, resulting in a session hijacking.
References list
Etiquetas
