CVE-2024-43381

CVSS V2 None CVSS V3 None
Description
reNgine is an automated reconnaissance framework for web applications. Versions 2.1.2 and prior are susceptible to Stored Cross-Site Scripting (XSS) attacks. This vulnerability occurs when scanning a domain, and if the target domain's DNS record contains an XSS payload, it leads to the execution of malicious scripts in the reNgine's dashboard view when any user views the scan results. The XSS payload is directly fetched from the DNS record of the remote target domain. Consequently, an attacker can execute the attack without requiring any additional input from the target or the reNgine user. A patch is available and expected to be part of version 2.1.3.
Overview
  • CVE ID
  • CVE-2024-43381
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-08-16T14:38:23.799Z
  • Last Modified Date
  • 2024-08-16T15:01:31.139Z
Weakness Enumerations
CWE URL
CWE-79 http://cwe.mitre.org/data/definitions/79.html
CWE-87 http://cwe.mitre.org/data/definitions/87.html
References
Reference URL Reference Tags
https://github.com/yogeshojha/rengine/security/advisories/GHSA-96q4-fj2m-jqf7 x_refsource_CONFIRM
https://github.com/yogeshojha/rengine/commit/064bac1c7c4d2b90745bf225c92e74d83edb7a4d x_refsource_MISC
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2024-43381
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43381
History
Created Old Value New Value Data Type Notes
2024-08-17 13:08:34 Added to TrackCVE