XSS Vulnerability in login page allows phishing attacks
CVE-2024-36494

4.7MEDIUM

Key Information:

Vendor

Image Access Gmbh

Status
Scan2net
Vendor
CVE Published:
12 December 2024

Badges

👾 Exploit Exists

What is CVE-2024-36494?

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The login page at /cgi/slogin.cgi suffers from XSS due to improper input filtering of the -tsetup+-uuser parameter, which can only be exploited if the target user is not already logged in. This makes it ideal for login form phishing attempts.

Affected Version(s)

Scan2Net 0

References

https://r.sec-consult.com/imageaccess
third-party-advisory
https://www.imageaccess.de/?page=SupportPortal&lang=en
patch

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Daniel Hirschberger (SEC Consult Vulnerability Lab)
Tobias Niemann (SEC Consult Vulnerability Lab)
JSON
.