CVE-2024-31159

{"id": "CVE-2024-31159", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "twcert@cert.org.tw", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2024-06-14T04:15:41.790", "references": [{"url": "https://www.twcert.org.tw/en/cp-139-7862-e43e4-2.html", "tags": ["Third Party Advisory"], "source": "twcert@cert.org.tw"}, {"url": "https://www.twcert.org.tw/tw/cp-132-7861-1a06f-1.html", "tags": ["Third Party Advisory"], "source": "twcert@cert.org.tw"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "twcert@cert.org.tw", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The parameter used in the certain page of ASUS Download Master is not properly filtered for user input. A remote attacker with administrative privilege can insert JavaScript code to the parameter for Reflected Cross-site scripting attacks."}, {"lang": "es", "value": "El par\u00e1metro utilizado en determinada p\u00e1gina de ASUS Download Master no se filtra correctamente para la entrada del usuario. Un atacante remoto con privilegios administrativos puede insertar c\u00f3digo JavaScript en el par\u00e1metro para ataques de Cross-site scripting reflejado."}], "lastModified": "2024-08-16T20:27:40.107", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:asus:download_master:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC91ABA7-A7BD-447E-9403-08F2C33A8802", "versionEndExcluding": "3.1.0.114"}], "operator": "OR"}]}], "sourceIdentifier": "twcert@cert.org.tw"}