Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger these vulnerabilities.This XSS is exploited through the name field of the database.
References
Link | Resource |
---|---|
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1704 | Exploit Third Party Advisory |
Configurations
History
13 Jul 2023, 01:54
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:milesight:milesightvpn:2.0.2:*:*:*:*:*:*:* | |
First Time |
Milesight milesightvpn
Milesight |
|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.7 |
References | (MISC) https://talosintelligence.com/vulnerability_reports/TALOS-2023-1704 - Exploit, Third Party Advisory |
06 Jul 2023, 15:16
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-07-06 15:15
Updated : 2024-02-28 20:13
NVD link : CVE-2023-24496
Mitre link : CVE-2023-24496
CVE.ORG link : CVE-2023-24496
JSON object : View
Products Affected
milesight
- milesightvpn
CWE
CWE-80
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)