CVE-2024-4176

An Cross site scripting vulnerability in the EDR XConsole before this release allowed an attacker to potentially leverage an XSS/HTML-Injection using command line variables. A malicious threat actor could execute commands on the victim's browser for sending carefully crafted malicious links to the EDR XConsole end user.
References
Configurations

Configuration 1 (hide)

cpe:2.3:a:trellix:xconsole:*:*:*:*:*:*:*:*

History

21 Nov 2024, 09:42

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 5.4
v2 : unknown
v3 : 4.1
References () https://thrive.trellix.com/s/article/000013455 - Permissions Required () https://thrive.trellix.com/s/article/000013455 - Permissions Required

15 Jul 2024, 16:43

Type Values Removed Values Added
References () https://thrive.trellix.com/s/article/000013455 - () https://thrive.trellix.com/s/article/000013455 - Permissions Required
First Time Trellix
Trellix xconsole
CPE cpe:2.3:a:trellix:xconsole:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : 4.1
v2 : unknown
v3 : 5.4

13 Jun 2024, 18:35

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de cross-site scripting en EDR XConsole antes de esta versión permitía a un atacante aprovechar potencialmente una inyección XSS/HTML utilizando variables de línea de comando. Un actor de amenazas malicioso podría ejecutar comandos en el navegador de la víctima para enviar enlaces maliciosos cuidadosamente elaborados al usuario final de EDR XConsole.

13 Jun 2024, 09:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-06-13 09:15

Updated : 2024-11-21 09:42


NVD link : CVE-2024-4176

Mitre link : CVE-2024-4176

CVE.ORG link : CVE-2024-4176


JSON object : View

Products Affected

trellix

  • xconsole
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')