VulnerabilityDeferred

CVE-2024-12021

Coverity versions prior to 2024.9.0 are vulnerable to stored cross-site scripting (XSS) in various administrative interfaces.

HIGH 8.5EPSS 0.38%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.38%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Coverity versions prior to 2024.9.0 are vulnerable to stored cross-site scripting (XSS) in various administrative interfaces. The impact of exploitation may result in the compromise of local accounts managed by the Coverity platform as well as other standard impacts resulting from cross-site scripting.

CVSS 4.0: 8.5 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.38% probability · 32th percentile
CISA KEV: Not listed
Weakness: CWE-79
Source: disclosure@synopsys.com

References

https://community.blackduck.com/s/article/Black-Duck-Product-Security-Advisory-CVE-2024-12021

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.