Kovah LinkAce up to 1.15.5 Edit Link URL cross site scripting

Summaryinfo

A vulnerability was found in Kovah LinkAce up to 1.15.5. It has been declared as problematic. Impacted is an unknown function of the component Edit Link Module. Executing a manipulation of the argument URL can lead to cross site scripting. The identification of this vulnerability is CVE-2024-56507. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Kovah LinkAce up to 1.15.5 and classified as problematic. This vulnerability affects some unknown processing of the component Edit Link Module. The manipulation of the argument URL with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. CVE summarizes:

LinkAce is a self-hosted archive to collect links of your favorite websites. Prior to 1.15.6, a reflected cross-site scripting (XSS) vulnerability exists in the LinkAce. This issue occurs in the "URL" field of the "Edit Link" module, where user input is not properly sanitized or encoded before being reflected in the HTML response. This allows attackers to inject and execute arbitrary JavaScript in the context of the victim’s browser, leading to potential session hijacking, data theft, and unauthorized actions. This vulnerability is fixed in 1.15.6.

The advisory is shared for download at github.com. This vulnerability was named CVE-2024-56507 since 12/26/2024. The exploitation appears to be easy. The attack can be initiated remotely. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

Upgrading to version 1.15.6 eliminates this vulnerability. Applying the patch c7cd6a323a03ccd89c7f905f7d9f2afc265b7b67 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Kovah

Name

• LinkAce

Version

• 1.15.0
• 1.15.1
• 1.15.2
• 1.15.3
• 1.15.4
• 1.15.5

License

• open-source

Website

• Product: https://github.com/Kovah/LinkAce/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion