Lucene search

LGECVELIST:CVE-2024-6177

HistoryJun 20, 2024 - 12:52 a.m.

CVE-2024-6177 XSS vulnerability in LG SuperSign CMS

2024-06-2000:52:25

CWE-79

LGE

www.cve.org

cve-2024-6177

lg supersign cms

xss vulnerability

input neutralization

web page generation

reflected xss

supersign cms 4.1.3

supersign cms 4.3.1

4.8 Medium

CVSS4

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

ACTIVE

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:N/SC:L/VI:N/SI:N/VA:N/SA:N

0.0005 Low

EPSS

Percentile

17.1%

JSON

Improper Neutralization of Input During Web Page Generation (XSS or ‘Cross-site Scripting’) vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This issue affects SuperSign CMS: from 4.1.3 before < 4.3.1.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SuperSign CMS",
    "vendor": "LG Electronics",
    "versions": [
      {
        "changes": [
          {
            "at": "4.3.1",
            "status": "unaffected"
          }
        ],
        "lessThan": "< 4.3.1",
        "status": "affected",
        "version": "4.1.3",
        "versionType": "custom"
      }
    ]
  }
]

References

lgsecurity.lge.com/bulletins/idproducts#updateDetails