Vulnerability · Published Apr 12, 2024 · Assigned by VulDB
CVE-2024-3687bihell Dice Comment cross site scripting
Low 3.5
In plain English
A low-severity cross-site scripting in Dice from bihell. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.5%top 59.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in bihell Dice 3.1.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Comment Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-260474 is the identifier assigned to this vulnerability.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
References
- VDB-260474 | bihell Dice Comment cross site scripting vdb-entry
- VDB-260474 | CTI Indicators (IOB, IOC, TTP) signature, permissions-required
- Submit #309445 | Dice CMS V3.1.0 Cross-Site Scripting third-party-advisory
- https://github.com/fubxx/CVE/blob/main/DiceCMS-XSS.md exploit