CVE-2024-27609 Bonita cross-site scripting vulnerability
Attackers can inject malicious scripts into the Bonita administration panel, potentially leading to session hijacking or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-27609?
CVE-2024-27609 is a medium-severity cross-site scripting vulnerability in n/a, published on 31 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Bonita before 2023.2-u2 allows stored XSS via a UI screen in the administration panel.
Weakness: CWE-79
Which versions are affected by CVE-2024-27609?
4 open source packages ship an affected version, including org.bonitasoft.console:bonita-web-server and org.bonitasoft.platform:platform-resources.
| Package | Affected | Fixed in |
|---|---|---|
org.bonitasoft.console:bonita-web-server Maven | All versions | 10.1.0.W11 |
org.bonitasoft.console:bonita-web-server Maven | All versions | 10.1.0.W11 |
org.bonitasoft.platform:platform-resources Maven | All versions | 10.1.0.W11 |
org.bonitasoft.platform:platform-resources Maven | All versions | 10.1.0.W11 |
How do I fix CVE-2024-27609?
Upgrade org.bonitasoft.console:bonita-web-server to 10.1.0.W11 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-27609 being exploited?
There is no known exploitation of CVE-2024-27609 in the wild and no public exploit code.
Sources
Also known as GHSA-8vj9-5v5q-fhch.