Vulnerability · Published Nov 1, 2024 · Assigned by twcert
CVE-2024-10652CHANGING Information Technology IDExpert - Reflected XSS
Medium 6.1
In plain English
A medium-severity cross-site scripting in IDExpert from CHANGING Information Technology. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.3%top 73.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
IDExpert from CHANGING Information Technology does not properly validate a parameter for a specific functionality, allowing unauthenticated remote attackers to inject JavsScript code and perform Reflected Cross-site scripting attacks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CHANGING Information Technology | IDExpert | 2.5 – through 2.8 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://www.twcert.org.tw/tw/cp-132-8172-a02cc-1.html third-party-advisory
- https://www.twcert.org.tw/en/cp-139-8173-f8bbc-2.html third-party-advisory