CVE-2024-50861

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-50861
The ip_mod_dns_key_form.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS. An attacker can inject malicious code into the "TSIG Key" field, which is saved in the database and triggers XSS when viewed, enabling data exfiltration and CSRF attacks.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
http://www.gestioip.net Product
https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50861 Exploit Third Party Advisory
https://github.com/muebel/gestioip-docker-compose Product
https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50861 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:gestioip:gestioip:3.5.7:*:*:*:*:*:*:*
History

06 Jun 2025, 15:40

Type Values Removed Values Added
First Time Gestioip
Gestioip gestioip
CPE cpe:2.3:a:gestioip:gestioip:3.5.7:*:*:*:*:*:*:*
References () http://www.gestioip.net - () http://www.gestioip.net - Product
References () https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50861 - () https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50861 - Exploit, Third Party Advisory
References () https://github.com/muebel/gestioip-docker-compose - () https://github.com/muebel/gestioip-docker-compose - Product

15 Jan 2025, 17:15

Type Values Removed Values Added
CWE CWE-79
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1
References () https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50861 - () https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50861 -
Summary
  • (es) La solicitud ip_mod_dns_key_form.cgi en GestioIP v3.5.7 es vulnerable a XSS almacenado. Un atacante puede inyectar código malicioso en el campo "TSIG Key", que se guarda en la base de datos y activa XSS cuando se visualiza, lo que permite la exfiltración de datos y los ataques CSRF.

15 Jan 2025, 00:15

Type Values Removed Values Added
Summary (en) The ip_mod_dns_key_form.cgi request in GestiolP v3.5.7 is vulnerable to Stored XSS. An attacker can inject malicious code into the "TSIG Key" field, which is saved in the database and triggers XSS when viewed, enabling data exfiltration and CSRF attacks. (en) The ip_mod_dns_key_form.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS. An attacker can inject malicious code into the "TSIG Key" field, which is saved in the database and triggers XSS when viewed, enabling data exfiltration and CSRF attacks.

14 Jan 2025, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-14 22:15

Updated : 2025-06-06 15:40

NVD link : CVE-2024-50861

Mitre link : CVE-2024-50861

CVE.ORG link : CVE-2024-50861

JSON object : View

Products Affected

gestioip

  • gestioip
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')