CVE-2024-5383 lakernote EasyAdmin upload cross site scripting

What is CVE-2024-5383?

CVE-2024-5383 is a medium-severity cross-site scripting vulnerability in lakernote EasyAdmin, published on 26 May 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability classified as problematic has been found in lakernote EasyAdmin up to 20240324. This affects an unknown part of the file /sys/file/upload. The manipulation of the argument file leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is 9c8a836ace17a93c45e5ad52a2340788b7795030. It is recommended to apply a patch to fix this issue. The identifier VDB-266301 was assigned to this vulnerability.

Weakness: CWE-79

Which versions are affected by CVE-2024-5383?

It affects 1 product.

Products include Lakernote Easyadmin.

How do I fix CVE-2024-5383?

No fix has been published for CVE-2024-5383 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2024-5383 being exploited?

There is no known exploitation of CVE-2024-5383 in the wild and no public exploit code.

Other vulnerabilities in lakernote EasyAdmin

• CVE-2024-2825 lakernote EasyAdmin saveReportFile path traversal Medium 6.3
• CVE-2024-2826 lakernote EasyAdmin saveReportFile xml external entity reference Medium 6.3
• CVE-2024-2827 lakernote EasyAdmin saveReportFile server-side request forgery Medium 6.3
• CVE-2024-2828 lakernote EasyAdmin IndexController.java thumbnail server-side request forgery Medium 6.3

Sources

• CVE record
• NVD
• OSV
• How this page is made