VulnerabilityAnalyzed

CVE-2024-52882

Due to improper neutralization of input via the devices API, an attacker can inject malicious JavaScript code (XSS) to attack logged-in administrator sessions.

MEDIUM 6.1EPSS 0.24%

Does this matter?

Lower severity and a low EPSS score (0.24%). Track it; it rarely justifies an emergency change on its own.

Description

An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to improper neutralization of input via the devices API, an attacker can inject malicious JavaScript code (XSS) to attack logged-in administrator sessions.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.24% probability · 15th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: audiocodes/one voice operations center
Source: cve@mitre.org

References

https://www.audiocodes.com/solutions-products/products/management-products-solutions/one-voice-operations-centerProduct
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-076.txtThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.