CVE-2024-3850 | THREATINT

Description

Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack (XSS). An attacker could send a user a URL that if clicked on could execute malicious JavaScript in their browser. This vulnerability also requires authentication before it can be exploited, so the scope and severity is limited. Also, even if JavaScript is executed, no additional benefits are obtained.

PUBLISHED Reserved 2024-04-15 | Published 2024-06-10 | Updated 2024-08-26 | Assigner icscert

MEDIUM: 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

MEDIUM: 4.8CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Problem types

CWE-79 Cross-site Scripting

Product status

Default status

unaffected

Any version before NVR-B3801.20.17.240507

affected

Credits

CISA discovered a public Proof of Concept (PoC) as authored by Bleron Rrustemi and reported it to Uniview. finder

References

github.com/...es/blob/main/http/cves/2024/CVE-2024-3850.yaml

www.cisa.gov/news-events/ics-advisories/icsa-24-156-01

cve.org (CVE-2024-3850)

nvd.nist.gov (CVE-2024-3850)

Download JSON