CVE-2024-3776

{"id": "CVE-2024-3776", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "twcert@cert.org.tw", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2024-04-15T04:15:16.340", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7730-584e3-1.html", "source": "twcert@cert.org.tw"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "twcert@cert.org.tw", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The parameter used in the login page of Netvision airPASS is not properly filtered for user input. An unauthenticated remote attacker can insert JavaScript code to the parameter for Reflected Cross-site scripting attacks."}, {"lang": "es", "value": "El par\u00e1metro utilizado en la p\u00e1gina de inicio de sesi\u00f3n de Netvision airPASS no est\u00e1 filtrado correctamente para la entrada del usuario. Un atacante remoto no autenticado puede insertar c\u00f3digo JavaScript en el par\u00e1metro para ataques de cross-site scripting reflejados."}], "lastModified": "2024-04-15T13:15:31.997", "sourceIdentifier": "twcert@cert.org.tw"}