CVE-2024-37846 Code injection in n/a

Critical 9.8 Published 25 Oct 2024 Updated 29 Oct 2024

An attacker can execute arbitrary code via Client-Side Template Injection in the MangoOS Platform Management Edit page.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-37846?

CVE-2024-37846 is a critical code injection vulnerability in n/a, published on 25 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

MangoOS before 5.2.0 was discovered to contain a Client-Side Template Injection (CSTI) vulnerability via the Platform Management Edit page.

Weakness: CWE-94

Which versions are affected by CVE-2024-37846?

It affects 1 product.

Products include Radixiot Mango.

How do I fix CVE-2024-37846?

No fix has been published for CVE-2024-37846 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2024-37846 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-37846 exists.

Sources

Also known as GHSA-2jf4-28jv-3rg7.