Lucene search
HistoryAug 26, 2024 - 8:15 p.m.
CVE-2024-44796
cve-2024-44796
cross-site scripting
azureredirect.php
picuploader
crafted payload
web scripts
html
error parameter
CVSS3
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
21.3%
A cross-site scripting (XSS) vulnerability in the component /auth/AzureRedirect.php of PicUploader commit fcf82ea allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the error_description parameter.
Affected configurations
Node
xiebrucepicuploaderRange<2024-02-13
| Vendor | Product | Version | CPE |
|---|---|---|---|
| xiebruce | picuploader | * | cpe:2.3:a:xiebruce:picuploader:*:*:*:*:*:*:*:* |
Related
cvelist
cvelist
CVE-2024-44796
2024-08-26 00:00:00
vulnrichment
vulnrichment
CVE-2024-44796
2024-08-26 00:00:00
cve
cve
CVE-2024-44796
2024-08-26 20:15:08
CVSS3
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
21.3%
Related for NVD:CVE-2024-44796