cvelistv5 - CVE-2024-28142

CVE-2024-28142 (GCVE-0-2024-28142)

Vulnerability from cvelistv5 – Published: 2024-12-12 12:35 – Updated: 2025-11-03 21:54

Summary

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "File Name" page (/cgi/uset.cgi?-cfilename) in the User Settings menu improperly filters the "file name" and wildcard character input field. By exploiting the wildcard character feature, attackers are able to store arbitrary Javascript code which is being triggered if the page is viewed afterwards, e.g. by higher privileged users such as admins. This attack can even be performed without being logged in because the affected functions are not fully protected. Without logging in, only the file name parameter of the "Default" User can be changed.

Severity ?

4.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Assigner

SEC-VLab

References

URL

Tags

	https://r.sec-consult.com/imageaccess	third-party-advisory
	https://www.imageaccess.de/?page=SupportPortal&lang=en	patch

Impacted products

	Vendor	Product	Version
	Image Access GmbH	Scan2Net	Affected: 0 , < 7.40 (custom)

Credits

Daniel Hirschberger (SEC Consult Vulnerability Lab) Tobias Niemann (SEC Consult Vulnerability Lab)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-28142",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-12T15:26:12.258053Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-12T15:29:48.542Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:54:26.598Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2024/Dec/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Scan2Net",
          "vendor": "Image Access GmbH",
          "versions": [
            {
              "changes": [
                {
                  "at": "7.40",
                  "status": "unaffected"
                }
              ],
              "lessThan": "7.40",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Daniel Hirschberger (SEC Consult Vulnerability Lab)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Tobias Niemann (SEC Consult Vulnerability Lab)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eDue to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The \"File Name\" page (\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e/cgi/uset.cgi?-cfilename) in the User Settings menu improperly filters the \"file name\" and wildcard character input field. By exploiting the wildcard character feature, attackers are able to store arbitrary Javascript code which is being triggered if the page is viewed afterwards, e.g. by higher privileged users such as admins.\u003c/span\u003e\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThis attack can even be performed without being logged in because the affected functions are not fully protected. Without logging in, only the file name parameter of the \"Default\" User can be changed.\u003c/span\u003e\u003cbr\u003e\u003c/div\u003e\u003c/div\u003e\u003cbr\u003e"
            }
          ],
          "value": "Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The \"File Name\" page (/cgi/uset.cgi?-cfilename) in the User Settings menu improperly filters the \"file name\" and wildcard character input field. By exploiting the wildcard character feature, attackers are able to store arbitrary Javascript code which is being triggered if the page is viewed afterwards, e.g. by higher privileged users such as admins.\n\n\n\n\n\n\n\n\n\nThis attack can even be performed without being logged in because the affected functions are not fully protected. Without logging in, only the file name parameter of the \"Default\" User can be changed."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The SEC Consult Vulnerability Lab has published proof of concept material in the technical security advisory.\u003cbr\u003e"
            }
          ],
          "value": "The SEC Consult Vulnerability Lab has published proof of concept material in the technical security advisory."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-63 Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-12T12:35:15.731Z",
        "orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
        "shortName": "SEC-VLab"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://r.sec-consult.com/imageaccess"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.imageaccess.de/?page=SupportPortal\u0026lang=en"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe vendor provides a firmware update to version 7.40 (or higher) which can be downloaded via the vendor\u0027s customer server portal.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "The vendor provides a firmware update to version 7.40 (or higher) which can be downloaded via the vendor\u0027s customer server portal."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Stored cross site scripting",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
    "assignerShortName": "SEC-VLab",
    "cveId": "CVE-2024-28142",
    "datePublished": "2024-12-12T12:35:15.731Z",
    "dateReserved": "2024-03-05T09:15:40.202Z",
    "dateUpdated": "2025-11-03T21:54:26.598Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The \\\"File Name\\\" page (/cgi/uset.cgi?-cfilename) in the User Settings menu improperly filters the \\\"file name\\\" and wildcard character input field. By exploiting the wildcard character feature, attackers are able to store arbitrary Javascript code which is being triggered if the page is viewed afterwards, e.g. by higher privileged users such as admins.\\n\\n\\n\\n\\n\\n\\n\\n\\n\\nThis attack can even be performed without being logged in because the affected functions are not fully protected. Without logging in, only the file name parameter of the \\\"Default\\\" User can be changed.\"}, {\"lang\": \"es\", \"value\": \"Debido a la falta de desinfecci\\u00f3n de entrada, un atacante puede realizar ataques cross-site-scripting y ejecutar c\\u00f3digo Javascript arbitrario en el navegador de otros usuarios. La p\\u00e1gina \\\"Nombre de archivo\\\" (/cgi/uset.cgi?-cfilename) en el men\\u00fa Configuraci\\u00f3n de usuario filtra incorrectamente el campo de entrada de \\\"nombre de archivo\\\" y el car\\u00e1cter comod\\u00edn. Al explotar la funci\\u00f3n de car\\u00e1cter comod\\u00edn, los atacantes pueden almacenar c\\u00f3digo Javascript arbitrario que se activa si la p\\u00e1gina se ve posteriormente, por ejemplo, por usuarios con privilegios superiores, como los administradores. Este ataque puede incluso realizarse sin iniciar sesi\\u00f3n porque las funciones afectadas no est\\u00e1n completamente protegidas. Sin iniciar sesi\\u00f3n, solo se puede cambiar el par\\u00e1metro de nombre de archivo del usuario \\\"Predeterminado\\\".\"}]",
      "id": "CVE-2024-28142",
      "lastModified": "2024-12-12T16:15:14.840",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N\", \"baseScore\": 4.7, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 1.4}]}",
      "published": "2024-12-12T13:15:09.763",
      "references": "[{\"url\": \"https://r.sec-consult.com/imageaccess\", \"source\": \"551230f0-3615-47bd-b7cc-93e92e730bbf\"}, {\"url\": \"https://www.imageaccess.de/?page=SupportPortal\u0026lang=en\", \"source\": \"551230f0-3615-47bd-b7cc-93e92e730bbf\"}]",
      "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"551230f0-3615-47bd-b7cc-93e92e730bbf\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-28142\",\"sourceIdentifier\":\"551230f0-3615-47bd-b7cc-93e92e730bbf\",\"published\":\"2024-12-12T13:15:09.763\",\"lastModified\":\"2025-11-03T22:16:50.053\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The \\\"File Name\\\" page (/cgi/uset.cgi?-cfilename) in the User Settings menu improperly filters the \\\"file name\\\" and wildcard character input field. By exploiting the wildcard character feature, attackers are able to store arbitrary Javascript code which is being triggered if the page is viewed afterwards, e.g. by higher privileged users such as admins.\\n\\n\\n\\n\\n\\n\\n\\n\\n\\nThis attack can even be performed without being logged in because the affected functions are not fully protected. Without logging in, only the file name parameter of the \\\"Default\\\" User can be changed.\"},{\"lang\":\"es\",\"value\":\"Debido a la falta de desinfecci\u00f3n de entrada, un atacante puede realizar ataques cross-site-scripting y ejecutar c\u00f3digo Javascript arbitrario en el navegador de otros usuarios. La p\u00e1gina \\\"Nombre de archivo\\\" (/cgi/uset.cgi?-cfilename) en el men\u00fa Configuraci\u00f3n de usuario filtra incorrectamente el campo de entrada de \\\"nombre de archivo\\\" y el car\u00e1cter comod\u00edn. Al explotar la funci\u00f3n de car\u00e1cter comod\u00edn, los atacantes pueden almacenar c\u00f3digo Javascript arbitrario que se activa si la p\u00e1gina se ve posteriormente, por ejemplo, por usuarios con privilegios superiores, como los administradores. Este ataque puede incluso realizarse sin iniciar sesi\u00f3n porque las funciones afectadas no est\u00e1n completamente protegidas. Sin iniciar sesi\u00f3n, solo se puede cambiar el par\u00e1metro de nombre de archivo del usuario \\\"Predeterminado\\\".\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"551230f0-3615-47bd-b7cc-93e92e730bbf\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"references\":[{\"url\":\"https://r.sec-consult.com/imageaccess\",\"source\":\"551230f0-3615-47bd-b7cc-93e92e730bbf\"},{\"url\":\"https://www.imageaccess.de/?page=SupportPortal\u0026lang=en\",\"source\":\"551230f0-3615-47bd-b7cc-93e92e730bbf\"},{\"url\":\"http://seclists.org/fulldisclosure/2024/Dec/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://seclists.org/fulldisclosure/2024/Dec/2\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T21:54:26.598Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 4.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-28142\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-12-12T15:26:12.258053Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-12-12T15:27:11.085Z\"}}], \"cna\": {\"title\": \"Stored cross site scripting\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Daniel Hirschberger (SEC Consult Vulnerability Lab)\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Tobias Niemann (SEC Consult Vulnerability Lab)\"}], \"impacts\": [{\"capecId\": \"CAPEC-63\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-63 Cross-Site Scripting (XSS)\"}]}], \"affected\": [{\"vendor\": \"Image Access GmbH\", \"product\": \"Scan2Net\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"7.40\", \"status\": \"unaffected\"}], \"version\": \"0\", \"lessThan\": \"7.40\", \"versionType\": \"custom\"}], \"defaultStatus\": \"affected\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"The SEC Consult Vulnerability Lab has published proof of concept material in the technical security advisory.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"The SEC Consult Vulnerability Lab has published proof of concept material in the technical security advisory.\u003cbr\u003e\", \"base64\": false}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"The vendor provides a firmware update to version 7.40 (or higher) which can be downloaded via the vendor\u0027s customer server portal.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eThe vendor provides a firmware update to version 7.40 (or higher) which can be downloaded via the vendor\u0027s customer server portal.\u003c/span\u003e\u003cbr\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://r.sec-consult.com/imageaccess\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://www.imageaccess.de/?page=SupportPortal\u0026lang=en\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The \\\"File Name\\\" page (/cgi/uset.cgi?-cfilename) in the User Settings menu improperly filters the \\\"file name\\\" and wildcard character input field. By exploiting the wildcard character feature, attackers are able to store arbitrary Javascript code which is being triggered if the page is viewed afterwards, e.g. by higher privileged users such as admins.\\n\\n\\n\\n\\n\\n\\n\\n\\n\\nThis attack can even be performed without being logged in because the affected functions are not fully protected. Without logging in, only the file name parameter of the \\\"Default\\\" User can be changed.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eDue to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The \\\"File Name\\\" page (\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e/cgi/uset.cgi?-cfilename) in the User Settings menu improperly filters the \\\"file name\\\" and wildcard character input field. By exploiting the wildcard character feature, attackers are able to store arbitrary Javascript code which is being triggered if the page is viewed afterwards, e.g. by higher privileged users such as admins.\u003c/span\u003e\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eThis attack can even be performed without being logged in because the affected functions are not fully protected. Without logging in, only the file name parameter of the \\\"Default\\\" User can be changed.\u003c/span\u003e\u003cbr\u003e\u003c/div\u003e\u003c/div\u003e\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"551230f0-3615-47bd-b7cc-93e92e730bbf\", \"shortName\": \"SEC-VLab\", \"dateUpdated\": \"2024-12-12T12:35:15.731Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-28142\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-03T21:54:26.598Z\", \"dateReserved\": \"2024-03-05T09:15:40.202Z\", \"assignerOrgId\": \"551230f0-3615-47bd-b7cc-93e92e730bbf\", \"datePublished\": \"2024-12-12T12:35:15.731Z\", \"assignerShortName\": \"SEC-VLab\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2024-28142

Vulnerability from fkie_nvd - Published: 2024-12-12 13:15 - Updated: 2025-11-03 22:16

Severity ?

4.7 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Summary

References

	URL	Tags
	551230f0-3615-47bd-b7cc-93e92e730bbf	https://r.sec-consult.com/imageaccess
	551230f0-3615-47bd-b7cc-93e92e730bbf	https://www.imageaccess.de/?page=SupportPortal&lang=en
	af854a3a-2127-422b-91ae-364da2661108	http://seclists.org/fulldisclosure/2024/Dec/2

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The \"File Name\" page (/cgi/uset.cgi?-cfilename) in the User Settings menu improperly filters the \"file name\" and wildcard character input field. By exploiting the wildcard character feature, attackers are able to store arbitrary Javascript code which is being triggered if the page is viewed afterwards, e.g. by higher privileged users such as admins.\n\n\n\n\n\n\n\n\n\nThis attack can even be performed without being logged in because the affected functions are not fully protected. Without logging in, only the file name parameter of the \"Default\" User can be changed."
    },
    {
      "lang": "es",
      "value": "Debido a la falta de desinfecci\u00f3n de entrada, un atacante puede realizar ataques cross-site-scripting y ejecutar c\u00f3digo Javascript arbitrario en el navegador de otros usuarios. La p\u00e1gina \"Nombre de archivo\" (/cgi/uset.cgi?-cfilename) en el men\u00fa Configuraci\u00f3n de usuario filtra incorrectamente el campo de entrada de \"nombre de archivo\" y el car\u00e1cter comod\u00edn. Al explotar la funci\u00f3n de car\u00e1cter comod\u00edn, los atacantes pueden almacenar c\u00f3digo Javascript arbitrario que se activa si la p\u00e1gina se ve posteriormente, por ejemplo, por usuarios con privilegios superiores, como los administradores. Este ataque puede incluso realizarse sin iniciar sesi\u00f3n porque las funciones afectadas no est\u00e1n completamente protegidas. Sin iniciar sesi\u00f3n, solo se puede cambiar el par\u00e1metro de nombre de archivo del usuario \"Predeterminado\"."
    }
  ],
  "id": "CVE-2024-28142",
  "lastModified": "2025-11-03T22:16:50.053",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-12-12T13:15:09.763",
  "references": [
    {
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "url": "https://r.sec-consult.com/imageaccess"
    },
    {
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "url": "https://www.imageaccess.de/?page=SupportPortal\u0026lang=en"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://seclists.org/fulldisclosure/2024/Dec/2"
    }
  ],
  "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "type": "Secondary"
    }
  ]
}

GSD-2024-28142

Vulnerability from gsd - Updated: 2024-03-06 06:02

Details

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Aliases

CVE-2024-28142

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-28142"
      ],
      "id": "GSD-2024-28142",
      "modified": "2024-03-06T06:02:27.106256Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2024-28142",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    }
  }
}

GHSA-68RW-C4GJ-CPCV

Vulnerability from github – Published: 2024-12-12 15:31 – Updated: 2025-11-04 00:32

Details

This attack can even be performed without being logged in because the affected functions are not fully protected. Without logging in, only the file name parameter of the "Default" User can be changed.

Severity ?

4.7 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-28142"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-12T13:15:09Z",
    "severity": "MODERATE"
  },
  "details": "Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The \"File Name\" page (/cgi/uset.cgi?-cfilename) in the User Settings menu improperly filters the \"file name\" and wildcard character input field. By exploiting the wildcard character feature, attackers are able to store arbitrary Javascript code which is being triggered if the page is viewed afterwards, e.g. by higher privileged users such as admins.\n\n\n\n\n\n\n\n\n\nThis attack can even be performed without being logged in because the affected functions are not fully protected. Without logging in, only the file name parameter of the \"Default\" User can be changed.",
  "id": "GHSA-68rw-c4gj-cpcv",
  "modified": "2025-11-04T00:32:15Z",
  "published": "2024-12-12T15:31:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28142"
    },
    {
      "type": "WEB",
      "url": "https://r.sec-consult.com/imageaccess"
    },
    {
      "type": "WEB",
      "url": "https://www.imageaccess.de/?page=SupportPortal\u0026lang=en"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2024/Dec/2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-28142 (GCVE-0-2024-28142)

FKIE_CVE-2024-28142

GSD-2024-28142

GHSA-68RW-C4GJ-CPCV

Tags

Sightings

Nomenclature