VulnerabilityDeferred

CVE-2024-36494

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users.

MEDIUM 4.7EPSS 0.47%

Does this matter?

Lower severity and a low EPSS score (0.47%). Track it; it rarely justifies an emergency change on its own.

Description

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The login page at /cgi/slogin.cgi suffers from XSS due to improper input filtering of the -tsetup+-uuser parameter, which can only be exploited if the target user is not already logged in. This makes it ideal for login form phishing attempts.

CVSS 3.1: 4.7 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
EPSS: 0.47% probability · 39th percentile
CISA KEV: Not listed
Weakness: CWE-79
Source: 551230f0-3615-47bd-b7cc-93e92e730bbf

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.