Cloudanix VulnDB

CVE-2024-27626

Medium · 6.1

CVSS

6.1

EPSS

0.4%

Published

Mar 21, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A problem in an administrative search tool could let attackers run harmful code in an administrator's browser simply by getting them to click a specially crafted link.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Data Exposure
Component
Application
Class
XSS
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Reflected Cross-Site Scripting in the admin panel search function allows injection of client-side scripts that execute in the context of an authenticated administrative user when the crafted search URL is loaded.

Why it matters to the business

Attackers could hijack admin sessions, exfiltrate data, or perform unauthorized actions within the application; the low EPSS and absence from KEV indicate limited observed exploitation but still requires prompt patching of the listed AlmaLinux packages.

How an attack unfolds

An attacker crafts a URL containing a malicious script in the search parameter of the admin panel, then delivers the link to a privileged user via phishing or another channel so that the script executes when the link is opened.

How to fix it

Upgrade freerdp-devel to version 2:2.1.1-1.el8 and vinagre to version 3.22.0-23.el8 on AlmaLinux 8 systems; additionally implement input sanitization and output encoding on all search inputs.

How to confirm the fix worked

Confirm package versions match the fixed releases using the system package manager, then test the search functionality with known benign XSS test vectors to verify reflection no longer occurs.

Typical attack path

  1. Locate the admin search endpoint
  2. Embed a script payload in the search query parameter
  3. Send the malicious link to an authenticated administrator
  4. Execute arbitrary actions such as cookie theft or privilege escalation within the victim's session

How to detect it

Inspect web server access logs for search requests containing HTML tags or script indicators; correlate with successful admin session activity from unexpected referrers.

  • search parameter containing <script
  • admin search URL with javascript:
  • unusual referrers in admin panel access logs

What your security team should do

  • Apply the listed package updates immediately on all AlmaLinux 8 hosts
  • Review admin panel access logs for unusual search queries
  • Enable web application firewall rules that block common reflected XSS patterns

The record

A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in Dotclear version 2.29. The flaw exists within the Search functionality of the Admin Panel.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:16.04:LTS dotclear 0 No fix
Ubuntu:Pro:16.04:LTS dotclear 0 No fix

Related vulnerabilities