CVE-2024-8457CWE-79

PLANET Technology switch devices - Stored cross-site scripting (XSS) in the User Management

Medium · published September 30, 2024

CVSS v3.1
4.8
EPSS
0%
Percentile
22.6
In the wild
Unconfirmed
What it is

Certain switch models from PLANET Technology have a web application that does not properly validate specific parameters, allowing remote authenticated users with administrator privileges to inject arbitrary JavaScript, leading to Stored XSS attack.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00310 · 22.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-09-30T07:39Z
EPSS history
Timeline
  • 30 SEP 07:39Z
    PLANET Technology switch devices - Stored cross-site scripting (XSS) in the User Management
    cvelistv5