Vulnerability · Published Dec 27, 2024 · Assigned by GitHub_M

CVE-2024-56507Reflected Cross-Site Scripting (XSS) Vulnerability in LinkAce

Medium 4.6

In plain English

A medium-severity cross-site scripting in LinkAce from Kovah. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)4.6Medium

Exploit odds (30 days)0.3%top 77.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

LinkAce is a self-hosted archive to collect links of your favorite websites. Prior to 1.15.6, a reflected cross-site scripting (XSS) vulnerability exists in the LinkAce. This issue occurs in the "URL" field of the "Edit Link" module, where user input is not properly sanitized or encoded before being reflected in the HTML response. This allows attackers to inject and execute arbitrary JavaScript in the context of the victim’s browser, leading to potential session hijacking, data theft, and unauthorized actions. This vulnerability is fixed in 1.15.6.

Affected products (as reported)

Vendor	Product	Versions
Kovah	LinkAce	< 1.15.6

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

References

https://github.com/Kovah/LinkAce/security/advisories/GHSA-cjcg-wj4p-pgc5 x_refsource_CONFIRM
https://github.com/Kovah/LinkAce/commit/c7cd6a323a03ccd89c7f905f7d9f2afc265b7b67 x_refsource_MISC