CVE-2024-28142

CVSS v3 4.7 MEDIUM

4.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

D

ue to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "File Name" page (/cgi/uset.cgi?-cfilename) in the User Settings menu improperly filters the "file name" and wildcard character input field. By exploiting the wildcard character feature, attackers are able to store arbitrary Javascript code which is being triggered if the page is viewed afterwards, e.g. by higher privileged users such as admins. This attack can even be performed without being logged in because the affected functions are not fully protected. Without logging in, only the file name parameter of the "Default" User can be changed.

References

Link	Resource
https://r.sec-consult.com/imageaccess
https://www.imageaccess.de/?page=SupportPortal&lang=en
http://seclists.org/fulldisclosure/2024/Dec/2

Configurations

No configuration.

History

03 Nov 2025, 22:16

Type	Values Removed	Values Added
References		() http://seclists.org/fulldisclosure/2024/Dec/2 -

12 Dec 2024, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-12-12 13:15

Updated : 2025-11-03 22:16

NVD link : CVE-2024-28142

Mitre link : CVE-2024-28142

CVE.ORG link : CVE-2024-28142

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-28142", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2024-12-12T13:15:09.763", "references": [{"url": "https://r.sec-consult.com/imageaccess", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}, {"url": "https://www.imageaccess.de/?page=SupportPortal&lang=en", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}, {"url": "http://seclists.org/fulldisclosure/2024/Dec/2", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The \"File Name\" page (/cgi/uset.cgi?-cfilename) in the User Settings menu improperly filters the \"file name\" and wildcard character input field. By exploiting the wildcard character feature, attackers are able to store arbitrary Javascript code which is being triggered if the page is viewed afterwards, e.g. by higher privileged users such as admins.\n\n\n\n\n\n\n\n\n\nThis attack can even be performed without being logged in because the affected functions are not fully protected. Without logging in, only the file name parameter of the \"Default\" User can be changed."}, {"lang": "es", "value": "Debido a la falta de desinfecci\u00f3n de entrada, un atacante puede realizar ataques cross-site-scripting y ejecutar c\u00f3digo Javascript arbitrario en el navegador de otros usuarios. La p\u00e1gina \"Nombre de archivo\" (/cgi/uset.cgi?-cfilename) en el men\u00fa Configuraci\u00f3n de usuario filtra incorrectamente el campo de entrada de \"nombre de archivo\" y el car\u00e1cter comod\u00edn. Al explotar la funci\u00f3n de car\u00e1cter comod\u00edn, los atacantes pueden almacenar c\u00f3digo Javascript arbitrario que se activa si la p\u00e1gina se ve posteriormente, por ejemplo, por usuarios con privilegios superiores, como los administradores. Este ataque puede incluso realizarse sin iniciar sesi\u00f3n porque las funciones afectadas no est\u00e1n completamente protegidas. Sin iniciar sesi\u00f3n, solo se puede cambiar el par\u00e1metro de nombre de archivo del usuario \"Predeterminado\"."}], "lastModified": "2025-11-03T22:16:50.053", "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf"}