Vulnerability · Published Dec 30, 2024 · Assigned by INCD

CVE-2024-47924Boa web server – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

High 7.5

In plain English

A high-severity cross-site scripting in Boa web from Boa web. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 55.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Boa web server – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products (as reported)

Vendor	Product	Versions
Boa web	Boa web	All versions – before The Boa web server is unsupported (EOL). Consider using an alternate product

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://www.gov.il/en/Departments/faq/cve_advisories