Lucene search

INCIBECVELIST:CVE-2024-4310

HistoryApr 29, 2024 - 12:35 p.m.

CVE-2024-4310 Cross-site Scripting (XSS) vulnerability in HubBank

2024-04-2912:35:48

CWE-79

INCIBE

www.cve.org

cve-2024-4310

cross-site scripting

hubbank

version 1.0.2

vulnerability

javascript payload

registration form

profile form

session takeover

CVSS3

6.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS

Percentile

9.0%

JSON

Cross-site Scripting (XSS) vulnerability in HubBank affecting version 1.0.2. This vulnerability allows an attacker to send a specially crafted JavaScript payload to registration and profile forms and trigger the payload when any authenticated user loads the page, resulting in a session takeover.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "HubBank",
    "vendor": "Ofofonobs",
    "versions": [
      {
        "status": "affected",
        "version": "1.0.2"
      }
    ]
  }
]

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-hubbank