{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/openpetra/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:openpetra:openpetra:2023.02:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2024-40509"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenPetra (2023.02)"],"_cs_severities":["high"],"_cs_tags":["xss","web-vulnerability"],"_cs_type":"advisory","_cs_vendors":["OpenPetra"],"content_html":"\u003cp\u003eOpenPetra version 2023.02 is vulnerable to an unauthenticated cross-site scripting (XSS) attack via the 'tab' parameter in the 'serverMFinDev.asmx' web service. An attacker can craft a malicious URL to inject arbitrary JavaScript, which executes when an authenticated user interacts with the application interface, specifically by hovering over the left index item. Successful exploitation allows for the theft of sensitive session cookies.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the theft of session cookies from authenticated users, potentially leading to full account takeover. The vulnerability is rated at CVSS 7.3.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of OpenPetra 2023.02 within the environment.\u003c/li\u003e\n\u003cli\u003eApply the latest available security patches or upgrades provided by the OpenPetra project to remediate CVE-2024-40509.\u003c/li\u003e\n\u003cli\u003eImplement Content Security Policy (CSP) headers to mitigate the impact of reflected XSS attacks.\u003c/li\u003e\n\u003cli\u003eHunt for exploitation attempts targeting the 'serverMFinDev.asmx' endpoint in web access logs.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-25T16:45:19Z","date_published":"2026-10-25T16:45:19Z","id":"https://feed.craftedsignal.io/briefs/2026-10-openpetra-xss/","summary":"OpenPetra version 2023.02 contains an unauthenticated XSS vulnerability in the serverMFinDev.asmx component that allows attackers to steal user session cookies.","title":"OpenPetra: Unauthenticated XSS in serverMFinDev.asmx (CVE-2024-40509)","url":"https://feed.craftedsignal.io/briefs/2026-10-openpetra-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - OpenPetra","version":"https://jsonfeed.org/version/1.1"}