CVE-2024-27122
published 2024-09-06CVE-2024-27122: A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow authenticated users to…
PriorityP423medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.25%
16.2th percentile
A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network.
We have already fixed the vulnerability in the following versions:
Notes Station 3 3.9.6 and later
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | gitpod-io_gitpod | 0 – 0.8.0 | — |
| qnap | notes_station_3 | >= 3.9.0 < 3.9.6 | 3.9.6 |
| qnap_systems_inc | notes_station_3 | >= 3.9.x < 3.9.6 | 3.9.6 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
osv4.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-m3pg-3mfc-5r65: A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3
ghsa_unreviewed·2024-09-06
CVE-2024-27122 [MEDIUM] CWE-79 GHSA-m3pg-3mfc-5r65: A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3
A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network.
We have already fixed the vulnerability in the following versions:
Notes Station 3 3.9.6 and later
OSV
CVE-2024-21583 in github.com/gitpod-io/gitpod
osv·2024-07-22·CVSS 4.1
CVE-2024-21583 CVE-2024-21583 in github.com/gitpod-io/gitpod
CVE-2024-21583 in github.com/gitpod-io/gitpod
CVE-2024-21583 in github.com/gitpod-io/gitpod.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/gitpod-io/gitpod before v0.1.5-main-gha.27122; github.com/gitpod-io/gitpod/components/server/go before main-gha.27122; github.com/gitpod-io/gitpod/components/ws-proxy before main-gha.27122; github.com/gitpod-io/gitpod/install/installer before main-gha.27122.
GHSA
github.com/gitpod-io/gitpod vulnerable to Cookie Tossing
ghsa·2024-07-19
CVE-2024-21583 [MEDIUM] CWE-15 github.com/gitpod-io/gitpod vulnerable to Cookie Tossing
github.com/gitpod-io/gitpod vulnerable to Cookie Tossing
Versions of the package github.com/gitpod-io/gitpod/components/server/go/pkg/lib before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/components/ws-proxy/pkg/proxy before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/auth before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/public-api-server before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/server before main-gha.27122; versions of the package @gitpod/gitpod-protocol before 0.1.5-main-gha.27122 are vulnerable to Cookie Tossing due to a missing __Host- prefix on the _gitpod_io_jwt2_ session cookie
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-09-06
Published