CVE-2024-9969

Published Oct 15, 2024

Last updated 4 months ago

CVSS medium 5.4

Overview

Description: NewType WebEIP v3.0 does not properly validate user input, allowing a remote attacker with regular privileges to insert JavaScript into specific parameters, resulting in a Reflected Cross-site Scripting (XSS) attack. The affected product is no longer maintained. It is recommended to upgrade to the new product.
Source: twcert@cert.org.tw
NVD status: Analyzed
CNA Tags: unsupported-when-assigned

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.4
Impact score: 2.7
Exploitability score: 2.3
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

twcert@cert.org.tw: CWE-79

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:newtype:webeip:3.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "647F475F-A3F3-476D-AC43-20C71E930735"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References