CVE-2023-24496

Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger these vulnerabilities.This XSS is exploited through the name field of the database.
References
Link Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1704 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:milesight:milesightvpn:2.0.2:*:*:*:*:*:*:*

History

13 Jul 2023, 01:54

Type Values Removed Values Added
CPE cpe:2.3:a:milesight:milesightvpn:2.0.2:*:*:*:*:*:*:*
First Time Milesight milesightvpn
Milesight
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 4.7
References (MISC) https://talosintelligence.com/vulnerability_reports/TALOS-2023-1704 - (MISC) https://talosintelligence.com/vulnerability_reports/TALOS-2023-1704 - Exploit, Third Party Advisory

06 Jul 2023, 15:16

Type Values Removed Values Added
New CVE

Information

Published : 2023-07-06 15:15

Updated : 2024-02-28 20:13


NVD link : CVE-2023-24496

Mitre link : CVE-2023-24496

CVE.ORG link : CVE-2023-24496


JSON object : View

Products Affected

milesight

  • milesightvpn
CWE
CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)