CVE-2024-31971 - OpenCVE

**UNSUPPORTED WHEN ASSIGNED** Multiple stored cross-site scripting (XSS) vulnerabilities on AdTran NetVanta 3120 18.01.01.00.E devices allow remote attackers to inject arbitrary JavaScript, as demonstrated by /mainPassword.html, /processIdentity.html, /public.html, /dhcp.html, /private.html, /hostname.html, /connectivity.html, /NetworkMonitor.html, /trafficMonitoringConfig.html, and /wizardMain.html.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Adtran	Netvanta 3120 Netvanta 3120 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:adtran:netvanta_3120_firmware:18.01.01.00.e:*:*:*:*:*:*:*

cpe:2.3:h:adtran:netvanta_3120:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/actuator/cve/blob/main/AdTran/CVE-2024-31971
https://github.com/actuator/cve/blob/main/AdTran/NetVanta-3120-XSS
https://supportcommunity.adtran.com/t5/NetVanta-Product-Notices/2019-Q2-NetVanta-3120-3130-EOL/ta-p/35715

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-07-24T00:00:00

Updated: 2024-08-02T01:59:50.899Z

Reserved: 2024-04-08T00:00:00

Link: CVE-2024-31971

Vulnrichment

Updated: 2024-07-24T18:34:55.840Z

NVD

Status : Modified

Published: 2024-07-24T15:15:11.800

Modified: 2024-07-26T21:15:12.610

Link: CVE-2024-31971

Redhat

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-31971", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-02T01:59:50.899Z", "dateReserved": "2024-04-08T00:00:00", "datePublished": "2024-07-24T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-07-26T21:07:17.815492"}, "descriptions": [{"lang": "en", "value": "**UNSUPPORTED WHEN ASSIGNED** Multiple stored cross-site scripting (XSS) vulnerabilities on AdTran NetVanta 3120 18.01.01.00.E devices allow remote attackers to inject arbitrary JavaScript, as demonstrated by /mainPassword.html, /processIdentity.html, /public.html, /dhcp.html, /private.html, /hostname.html, /connectivity.html, /NetworkMonitor.html, /trafficMonitoringConfig.html, and /wizardMain.html."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/actuator/cve/blob/main/AdTran/NetVanta-3120-XSS"}, {"url": "https://github.com/actuator/cve/blob/main/AdTran/CVE-2024-31971"}, {"url": "https://supportcommunity.adtran.com/t5/NetVanta-Product-Notices/2019-Q2-NetVanta-3120-3130-EOL/ta-p/35715"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-24T18:34:52.640047Z", "id": "CVE-2024-31971", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-24T18:35:00.294Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:59:50.899Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/actuator/cve/blob/main/AdTran/NetVanta-3120-XSS", "tags": ["x_transferred"]}, {"url": "https://github.com/actuator/cve/blob/main/AdTran/CVE-2024-31971", "tags": ["x_transferred"]}, {"url": "https://supportcommunity.adtran.com/t5/NetVanta-Product-Notices/2019-Q2-NetVanta-3120-3130-EOL/ta-p/35715", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:adtran:netvanta_3120_firmware:18.01.01.00.e:*:*:*:*:*:*:*", "matchCriteriaId": "95586C6D-B517-45D8-970B-C6CF70AC69F9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:adtran:netvanta_3120:-:*:*:*:*:*:*:*", "matchCriteriaId": "5E7752AF-0B4A-41CE-81B5-8F6053E3C483", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "**UNSUPPORTED WHEN ASSIGNED** Multiple stored cross-site scripting (XSS) vulnerabilities on AdTran NetVanta 3120 18.01.01.00.E devices allow remote attackers to inject arbitrary JavaScript, as demonstrated by /mainPassword.html, /processIdentity.html, /public.html, /dhcp.html, /private.html, /hostname.html, /connectivity.html, /NetworkMonitor.html, /trafficMonitoringConfig.html, and /wizardMain.html."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de Cross Site Scripting (XSS) almacenadas en dispositivos AdTran NetVanta 3120 18.01.01.00.E permiten a atacantes remotos inyectar JavaScript de su elecci\u00f3n, como lo demuestran /mainPassword.html, /processIdentity.html, /public.html, /dhcp.html , /private.html, /hostname.html, /connectivity.html, /NetworkMonitor.html, /trafficMonitoringConfig.html y /wizardMain.html."}], "id": "CVE-2024-31971", "lastModified": "2024-07-26T21:15:12.610", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-07-24T15:15:11.800", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/actuator/cve/blob/main/AdTran/CVE-2024-31971"}, {"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "https://github.com/actuator/cve/blob/main/AdTran/NetVanta-3120-XSS"}, {"source": "cve@mitre.org", "url": "https://supportcommunity.adtran.com/t5/NetVanta-Product-Notices/2019-Q2-NetVanta-3120-3130-EOL/ta-p/35715"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}