Vulnerability · Published Jul 6, 2023 · Assigned by talos
CVE-2023-24496
Medium 4.7
In plain English
A medium-severity security flaw in MilesightVPN from Milesight. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.1)4.7Medium
Exploit odds (30 days)0.6%top 52.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger these vulnerabilities.This XSS is exploited through the name field of the database.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Milesight | MilesightVPN | v2.0.2 |
Weakness: CWE-80 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N