CVE-2024-3800

2024-06-2813:15:02

CWE-79

[email protected]

web.nvd.nist.gov

cve-2024-3800

s@m cms

concept intermedia

reflected xss

file name inclusion

vulnerability

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Sites managed in S@M CMS (Concept Intermedia) might be vulnerable to Reflected XSS via including scripts in requested file names.
Only a part of observed services is vulnerable, but since vendor has not investigated the root problem, it is hard to determine when the issue appears.

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "S@M CMS",
    "vendor": "Concept Intermedia",
    "versions": [
      {
        "lessThanOrEqual": "3.3",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

References

cert.pl/en/posts/2024/06/CVE-2024-3800

cert.pl/posts/2024/06/CVE-2024-3800