Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger these vulnerabilities.This XSS is exploited through the name field of the database.
References
| Link | Resource |
|---|---|
| https://talosintelligence.com/vulnerability_reports/TALOS-2023-1704 | Exploit Third Party Advisory |
| https://talosintelligence.com/vulnerability_reports/TALOS-2023-1704 | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 07:47
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://talosintelligence.com/vulnerability_reports/TALOS-2023-1704 - Exploit, Third Party Advisory |
13 Jul 2023, 01:54
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:milesight:milesightvpn:2.0.2:*:*:*:*:*:*:* | |
| First Time |
Milesight milesightvpn
Milesight |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.7 |
| References | (MISC) https://talosintelligence.com/vulnerability_reports/TALOS-2023-1704 - Exploit, Third Party Advisory |
06 Jul 2023, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-07-06 15:15
Updated : 2024-11-21 07:47
NVD link : CVE-2023-24496
Mitre link : CVE-2023-24496
CVE.ORG link : CVE-2023-24496
JSON object : View
Products Affected
milesight
- milesightvpn
CWE
CWE-80
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)