Cross-site Scripting (XSS) Vulnerability in MBE eShip

CVE-2024-37953

What is CVE-2024-37953?

The MBE eShip application by MBE Worldwide S.P.A. is susceptible to a reflected cross-site scripting (XSS) vulnerability due to improper neutralization of user input during the web page generation process. This vulnerability allows attackers to execute arbitrary scripts in a user's browser, potentially leading to session hijacking, redirection to malicious sites, or the exposure of sensitive information. Affected versions include MBE eShip from n/a through 2.1.2, which may not correctly sanitize user inputs in web requests. Organizations using this product should implement immediate measures to mitigate the risk associated with this vulnerability.

References