CVE-2024-10033
published 2024-10-16CVE-2024-10033: A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to…
PriorityP425medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.38%
30.3th percentile
A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | ansible_automation_platform | — | — |
| redhat | ansible_developer | — | — |
| redhat | ansible_inside | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
aap-gateway: XSS on aap-gateway
vendor_redhat·2024-10-16·CVSS 6.1
CVE-2024-10033 [MEDIUM] CWE-79 aap-gateway: XSS on aap-gateway
aap-gateway: XSS on aap-gateway
A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.
A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.
Mitigation: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria com
GHSA
GHSA-h596-hg59-cxrq: A vulnerability was found in aap-gateway
ghsa_unreviewed·2024-10-16
CVE-2024-10033 [MEDIUM] CWE-79 GHSA-h596-hg59-cxrq: A vulnerability was found in aap-gateway
A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.
Suricata
ET WEB_SPECIFIC_APPS Wordpress Host Header Injection (CVE-2016-10033) M2
suricata·2017-05-05·CVSS 9.8
CVE-2016-10033 [CRITICAL] ET WEB_SPECIFIC_APPS Wordpress Host Header Injection (CVE-2016-10033) M2
ET WEB_SPECIFIC_APPS Wordpress Host Header Injection (CVE-2016-10033) M2
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Wordpress Host Header Injection (CVE-2016-10033) M2"; flow:established,to_server; http.uri; content:"action=lostpassword"; nocase; fast_pattern; http.host; pcre:"/^[^\r\n]+?[\x28\x29\x27\x22\x7b\x7d]/"; reference:url,exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html; classtype:web-application-attack; sid:2024278; rev:5; metadata:affected_product Wordpress, attack_target Web_Server, created_at 2017_05_05, cve CVE_2016_10033, deployment Perimeter, signature_severity Major, updated_at 2024_03_25;)
Suricata
ET WEB_SPECIFIC_APPS Wordpress Host Header Injection (CVE-2016-10033) M3
suricata·2017-05-05·CVSS 9.8
CVE-2016-10033 [CRITICAL] ET WEB_SPECIFIC_APPS Wordpress Host Header Injection (CVE-2016-10033) M3
ET WEB_SPECIFIC_APPS Wordpress Host Header Injection (CVE-2016-10033) M3
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Wordpress Host Header Injection (CVE-2016-10033) M3"; flow:established,to_server; http.header; content:"substr{"; nocase; fast_pattern; http.host; pcre:"/^[^\r\n]+?[\x28\x29\x27\x22\x7b\x7d]/"; reference:url,exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html; classtype:web-application-attack; sid:2024279; rev:5; metadata:affected_product Wordpress, attack_target Web_Server, created_at 2017_05_05, cve CVE_2016_10033, deployment Perimeter, signature_severity Major, updated_at 2024_03_25;)
No public exploits indexed.
No writeups or analysis indexed.
2024-10-16
Published