Lucene search

TwcertCVELIST:CVE-2024-4302

HistoryApr 29, 2024 - 5:46 a.m.

CVE-2024-4302 Super 8 livechat SDK - Cross-site Scripting

2024-04-2905:46:52

CWE-79

twcert

www.cve.org

super 8

live chat

xss

vulnerability

remote attackers

javascript code

filter failure

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.0005 Low

EPSS

Percentile

17.0%

JSON

Super 8 Live Chat online customer service platform fails to properly filter user input, allowing unauthenticated remote attackers to insert JavaScript code into the chat box. When the message recipient views the message, they become susceptible to Cross-site Scripting (XSS) attacks.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "livechat SDK",
    "vendor": "Super 8",
    "versions": [
      {
        "lessThanOrEqual": "4.5.0",
        "status": "affected",
        "version": "earlier",
        "versionType": "custom"
      }
    ]
  }
]

References

www.twcert.org.tw/tw/cp-132-7779-35562-1.html

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.0005 Low

EPSS

Percentile

17.0%

JSON

Related for CVELIST:CVE-2024-4302