CVE-2024-29183: OpenRASP vulnerable to a reflected Cross-Site Scripting (XSS) attack in /login

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-19 · updated 2026-06-17
Weakness: CWE-79

Description

OpenRASP is a RASP solution that directly integrates its protection engine into the application server by instrumentation. There exists a reflected XSS in the /login page due to a reflection of the redirect parameter. This allows an attacker to execute arbitrary javascript with the permissions of a user after the user logins with their account.

Affected products

Baidu Openrasp: from 1.3.7* through 1.3.7

References

https://github.com/baidu/openrasp/commit/240fde3901c7a36aaade3683ffd5c89140a535fb
https://securitylab.github.com/advisories/GHSL-2023-253_openrasp
https://github.com/baidu/openrasp/commit/240fde3901c7a36aaade3683ffd5c89140a535fb
https://securitylab.github.com/advisories/GHSL-2023-253_openrasp

Get alerted when CVE-2024-29183 or the next vulnerability affects your stack