Lucene search

IcscertCVE-2024-41725

HistorySep 25, 2024 - 1:15 a.m.

CVE-2024-41725

2024-09-2501:15:41

CWE-79

icscert

web.nvd.nist.gov

progauge maglink lx console

input filtering

vulnerability

cross site scripting

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS4

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

PASSIVE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

17.7%

JSON

ProGauge MAGLINK LX CONSOLE does not have sufficient filtering on input
fields that are used to render pages which may allow cross site
scripting.

Affected configurations

Nvd

Node

doverfuelingsolutionsprogauge_maglink_lx_console_firmwareRange≤3.4.2.2.6

AND

doverfuelingsolutionsprogauge_maglink_lx_consoleMatch-

Node

doverfuelingsolutionsprogauge_maglink_lx4_console_firmwareRange≤4.17.9e

AND

doverfuelingsolutionsprogauge_maglink_lx4_consoleMatch-

VendorProductVersionCPE
doverfuelingsolutionsprogauge_maglink_lx_console_firmware*cpe:2.3:o:doverfuelingsolutions:progauge_maglink_lx_console_firmware:*:*:*:*:*:*:*:*
doverfuelingsolutionsprogauge_maglink_lx_console-cpe:2.3:h:doverfuelingsolutions:progauge_maglink_lx_console:-:*:*:*:*:*:*:*
doverfuelingsolutionsprogauge_maglink_lx4_console_firmware*cpe:2.3:o:doverfuelingsolutions:progauge_maglink_lx4_console_firmware:*:*:*:*:*:*:*:*
doverfuelingsolutionsprogauge_maglink_lx4_console-cpe:2.3:h:doverfuelingsolutions:progauge_maglink_lx4_console:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
doverfuelingsolutions	progauge_maglink_lx_console_firmware	*	cpe:2.3:o:doverfuelingsolutions:progauge_maglink_lx_console_firmware::::::::
doverfuelingsolutions	progauge_maglink_lx_console	-	cpe:2.3:h:doverfuelingsolutions:progauge_maglink_lx_console:-:::::::*
doverfuelingsolutions	progauge_maglink_lx4_console_firmware	*	cpe:2.3:o:doverfuelingsolutions:progauge_maglink_lx4_console_firmware::::::::
doverfuelingsolutions	progauge_maglink_lx4_console	-	cpe:2.3:h:doverfuelingsolutions:progauge_maglink_lx4_console:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "ProGauge MAGLINK LX CONSOLE",
    "vendor": "Dover Fueling Solutions (DFS)",
    "versions": [
      {
        "lessThanOrEqual": "3.4.2.2.6",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "ProGauge MAGLINK LX4 CONSOLE",
    "vendor": "Dover Fueling Solutions (DFS)",
    "versions": [
      {
        "lessThanOrEqual": "4.17.9e",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/news-events/ics-advisories/icsa-24-268-04

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS4

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

PASSIVE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

17.7%

JSON

Related for CVE-2024-41725