CVE-2024-47826: fallo de gravedad baja en elabftw
eLabFTW vulnerable to HTML Injection in extended search error message
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
8Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 3.5epss 0.3%
eLabFTW is an open source electronic lab notebook for research labs. A vulnerability in versions prior to 5.1.5 allows an attacker to inject arbitrary HTML tags in the pages: "experiments.php" (show mode), "database.php" (show mode) or "search.php". It works by providing HTML code in the extended search string, which will then be displayed back to the user in the error message. This means that injected HTML will appear in a red "alert/danger" box, and be part of an error message. Due to some other security measures, it is not possible to execute arbitrary javascript from this attack. As such, this attack is deemed low impact. Users should upgrade to at least version 5.1.5 to receive a patch. No known workarounds are available.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L
Productos afectados
elabftw · elabftwCVEs relacionadas — elabftw
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-31007MEDIUMPrivilege escalation from administrator in eLabFTWEPSS 26.9%CVE-2021-41171MEDIUMBypass bruteforce protection on login form in elabftwEPSS 1.9%CVE-2021-43834CRITICALIncorrect Authentication in elabftwEPSS 1.0%CVE-2021-32698MEDIUMBlind Server-Side Request Forgery (SSRF) in eLabFTWEPSS 0.9%CVE-2021-43833HIGHAccount takeover in eLabFTWEPSS 0.8%CVE-2022-31178MEDIUMImproper Authorization in eLabFTWEPSS 0.5%