Home

Description

Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not being sanitized.

PUBLISHED Reserved 2024-09-06 | Published 2025-11-19 | Updated 2025-11-19 | Assigner Carrier




MEDIUM: 5.4CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

Default status
unaffected

6.0 (semver)
affected

Default status
unaffected

6.0 (semver)
affected

Credits

Jaryl Low finder

Thuy D. Nguyen finder

Cynthia E. Irvine finder

References

www.corporate.carrier.com/...-security/advisories-resources/

cve.org (CVE-2024-8528)

nvd.nist.gov (CVE-2024-8528)

Download JSON