OpenPetra (2023.02) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/openpetra-2023.02/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 25 Oct 2026 16:45:19 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOpenPetra: Unauthenticated XSS in serverMFinDev.asmx (CVE-2024-40509)https://feed.craftedsignal.io/briefs/2026-10-openpetra-xss/Sun, 25 Oct 2026 16:45:19 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-openpetra-xss/OpenPetra version 2023.02 contains an unauthenticated XSS vulnerability in the serverMFinDev.asmx component that allows attackers to steal user session cookies.OpenPetra version 2023.02 is vulnerable to an unauthenticated cross-site scripting (XSS) attack via the 'tab' parameter in the 'serverMFinDev.asmx' web service. An attacker can craft a malicious URL to inject arbitrary JavaScript, which executes when an authenticated user interacts with the application interface, specifically by hovering over the left index item. Successful exploitation allows for the theft of sensitive session cookies.

Impact

Successful exploitation results in the theft of session cookies from authenticated users, potentially leading to full account takeover. The vulnerability is rated at CVSS 7.3.

Recommendation

  • Identify all instances of OpenPetra 2023.02 within the environment.
  • Apply the latest available security patches or upgrades provided by the OpenPetra project to remediate CVE-2024-40509.
  • Implement Content Security Policy (CSP) headers to mitigate the impact of reflected XSS attacks.
  • Hunt for exploitation attempts targeting the 'serverMFinDev.asmx' endpoint in web access logs.
]]>highadvisoryxssweb-vulnerability