CVE-2024-3850CWE-79

Uniview NVR301-04S2-P4 Cross-site Scripting

Medium · published June 10, 2024

CVSS v4.0
4.8
EPSS
1%
Percentile
59.1
In the wild
Unconfirmed
What it is

Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack (XSS). An attacker could send a user a URL that if clicked on could execute malicious JavaScript in their browser. This vulnerability also requires authentication before it can be exploited, so the scope and severity is limited. Also, even if JavaScript is executed, no additional benefits are obtained.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00893 · 59.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-06-10T16:46Z
EPSS history
Timeline
  • 10 JUN 16:46Z
    Uniview NVR301-04S2-P4 Cross-site Scripting
    cvelistv5