Cross-Site Scripting vulnerability in Gophish Admin Panel

Posted date 06/03/2024
Importance
3 - Medium
Affected Resources

Admin Panel, version 0.12.1.

Description

INCIBE has coordinated the publication of a medium severity vulnerability affecting Gophish Admin Panel version 0.12.1, an open source framework for creating phishing platforms and checking the organisation's exposure, which was discovered by Miguel Segovia Gil.

This vulnerability has been assigned the following code, CVSS v3.1 base score, CVSS vector and vulnerability type CWE:

  • CVE-2024-2211: 4.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N | CWE-79.
Solution

There is no reported solution at this time.

Detail

CVE-2024-2211: Cross-Site Scripting stored vulnerability in Gophish affecting version 0.12.1. This vulnerability could allow an attacker to store a malicious JavaScript payload in the campaign menu and trigger the payload when the campaign is removed from the menu.