CVE-2024-46083

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-46083
Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS). An authenticated user can craft malicious payloads using the messages feature, which allows the injection of malicious code into any user's account on the platform. It is important to note that regular users can trigger actions for administrator users.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://blog.hawktesters.com/zero-day-alert-scriptcase-vulnerabilities-xss/ Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:scriptcase:scriptcase:*:*:*:*:*:*:*:*
History

28 Apr 2025, 17:16

Type Values Removed Values Added
CPE cpe:2.3:a:scriptcase:scriptcase:*:*:*:*:*:*:*:*
First Time Scriptcase
Scriptcase scriptcase
References () https://blog.hawktesters.com/zero-day-alert-scriptcase-vulnerabilities-xss/ - () https://blog.hawktesters.com/zero-day-alert-scriptcase-vulnerabilities-xss/ - Exploit, Third Party Advisory

04 Oct 2024, 13:51

Type Values Removed Values Added
Summary
  • (es) Scriptcase v9.10.023 y versiones anteriores son vulnerables a ataques de Cross-Site Scripting (XSS). Un usuario autenticado puede manipular payloads maliciosos mediante la función de mensajes, que permite la inyección de código malicioso en la cuenta de cualquier usuario de la plataforma. Es importante tener en cuenta que los usuarios normales pueden activar acciones para los usuarios administradores.

01 Oct 2024, 20:35

Type Values Removed Values Added
CWE CWE-79
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.4

01 Oct 2024, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-01 19:15

Updated : 2025-04-28 17:16

NVD link : CVE-2024-46083

Mitre link : CVE-2024-46083

CVE.ORG link : CVE-2024-46083

JSON object : View

Products Affected

scriptcase

  • scriptcase
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')