Lucene search

[email protected]NVD:CVE-2024-4337

HistoryApr 30, 2024 - 10:15 a.m.

CVE-2024-4337

2024-04-3010:15:08

CWE-79

[email protected]

web.nvd.nist.gov

adive framework

xss

vulnerability

cross-site scripting

input encoding

session retrieval

CVSS3

7.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

EPSS

Percentile

9.0%

JSON

Adive Framework 2.0.8, does not sufficiently encode user-controlled inputs, resulting in a persistent Cross-Site Scripting (XSS) vulnerability via the /adive/admin/nav/add, in multiple parameters. This vulnerability allows an attacker to retrieve the session details of an authenticated user.

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-adive-framework