CVE-2024-55416

Nuclei

DevDojo Voyager vulnerable to reflected Cross-site Scripting

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

EIP currently links 1 Nuclei template to CVE-2024-55416.

Description

DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Javascript can be executed.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 30, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

tcg/voyager

Browse Packagist / tcg/voyager
GitHub AdvisoryThrough 1.8.0affected

Nuclei templates

1
ProjectDiscoveryLOWDevDojo Voyager <=1.8.0 - Cross-Site Scripting

DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Javascript can be executed.

Impact

Authenticated attackers can craft malicious links that execute arbitrary JavaScript in the context of an administrator's session when clicked, potentially leading to account compromise or privilege escalation.

Remediation

Update DevDojo Voyager to version 1.8.1 or later to address the reflected XSS vulnerability.

Authorsiamnoooob, rootxharsh, pdresearch
Template tagscvecve2024devdojoxssauthenticatedvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Shodan: title:"Voyager"
https://www.sonarsource.com/blog/the-tainted-voyage-uncovering-voyagers-vulnerabilities/ https://github.com/thedevdojo/voyager/blob/1.6/resources/views/master.blade.php#L132 https://github.com/thedevdojo/voyager/blob/1.6/src/Http/Controllers/VoyagerCompassController.php#L44 https://nvd.nist.gov/vuln/detail/CVE-2024-55416

Source: ProjectDiscovery

References

5