Lucene search

KasperskyCVE-2024-8652

HistorySep 19, 2024 - 5:15 p.m.

CVE-2024-8652

2024-09-1917:15:15

CWE-79

Kaspersky

web.nvd.nist.gov

netcat cms

vulnerability

remote code execution

patch

javascript

browser.

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS4

5.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

ACTIVE

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/SC:N/VI:L/SI:N/VA:H/SA:N

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

17.7%

JSON

A vulnerability in NetCat CMS allows an attacker to execute JavaScript code in a user’s browser when they visit specific path on the site.
This issue affects NetCat CMS v. 6.4.0.24126.2 and possibly others.

Apply patch from vendor https://netcat.ru/ https://netcat.ru/] . Versions 6.4.0.24248 and on have the patch.

Affected configurations

Nvd

Node

netcatnetcat_content_management_systemRange<6.4.0.24248-

VendorProductVersionCPE
netcatnetcat_content_management_system*cpe:2.3:a:netcat:netcat_content_management_system:*:*:*:*:-:*:*:*

Vendor	Product	Version	CPE
netcat	netcat_content_management_system	*	cpe:2.3:a:netcat:netcat_content_management_system:::::-:::*

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "NetCat CMS",
    "vendor": "NetCat",
    "versions": [
      {
        "status": "affected",
        "version": "6.4.0.24126.2"
      },
      {
        "status": "unaffected",
        "version": "6.4.0.24248"
      }
    ]
  }
]

References

github.com/klsecservices/Advisories/blob/master/K-NetCat-2024-002.md

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS4

5.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

ACTIVE

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/SC:N/VI:L/SI:N/VA:H/SA:N

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

17.7%

JSON

Related for CVE-2024-8652