Lucene search

INCDVULNRICHMENT:CVE-2024-36392

HistoryJun 02, 2024 - 1:24 p.m.

CVE-2024-36392 MileSight DeviceHub - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

2024-06-0213:24:33

CWE-79

INCD

github.com

milesight devicehub

cve-2024-36392

cross-site scripting

cwe-79

web page generation

improper neutralization

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

MileSight DeviceHub - CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "DeviceHub",
    "vendor": "MileSight",
    "versions": [
      {
        "lessThan": "Upgrade to the latest version.",
        "status": "affected",
        "version": "v3.0.1-r1 for Ubuntu 20.04",
        "versionType": "custom"
      }
    ]
  }
]

References

www.gov.il/en/Departments/faq/cve_advisories

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for VULNRICHMENT:CVE-2024-36392