CVE-2023-24496

Published Jul 6, 2023

Last updated a year ago

CVSS medium 4.7

Overview

Description: Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger these vulnerabilities.This XSS is exploited through the name field of the database.
Source: talos-cna@cisco.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 4.7
Impact score: 2.7
Exploitability score: 1.6
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

talos-cna@cisco.com: CWE-80

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:milesight:milesightvpn:2.0.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4943376D-ADEB-4BC5-BAF4-81C14233E3C0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References