Lucene search

K
cve[email protected]CVE-2024-24907
HistoryMar 01, 2024 - 2:15 p.m.

CVE-2024-24907

2024-03-0114:15:53
CWE-79
web.nvd.nist.gov
44
cve-2024-24907
dell secure connect gateway
scg
policy manager
stored cross-site scripting
vulnerability
filters page
html
javascript
exploitation
information disclosure
session theft
client-side request forgery
nvd

7.6 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

8.8%

Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability in the Filters page. An adjacent network high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Secure Connect Gateway (SCG) Policy Manager",
    "vendor": "Dell",
    "versions": [
      {
        "lessThan": "5.22.00.16",
        "status": "affected",
        "version": "N/A",
        "versionType": "semver"
      }
    ]
  }
]

7.6 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

8.8%

Related for CVE-2024-24907