CVE-2024-47917 - Vulnerability Details - OpenCVE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://www.gov.il/en/Departments/faq/cve_advisories

History

Mon, 30 Dec 2024 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 30 Dec 2024 09:45:00 +0000

Type	Values Removed	Values Added
Description		CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Title		Mobotix - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Weaknesses		CWE-79
References		https://www.gov.il/en/Departments/faq/cve_advisories
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: INCD

Published: 2024-12-30T09:40:10.453Z

Updated: 2024-12-30T16:20:48.446Z

Reserved: 2024-10-06T07:19:12.342Z

Link: CVE-2024-47917

Vulnrichment

Updated: 2024-12-30T16:20:42.713Z

NVD

Status : Received

Published: 2024-12-30T10:15:06.067

Modified: 2024-12-30T10:15:06.067

Link: CVE-2024-47917

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-47917", "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "state": "PUBLISHED", "assignerShortName": "INCD", "dateReserved": "2024-10-06T07:19:12.342Z", "datePublished": "2024-12-30T09:40:10.453Z", "dateUpdated": "2024-12-30T16:20:48.446Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "CCTV FW", "vendor": "Mobotix", "versions": [{"lessThanOrEqual": "version MX-V3.4.2.16", "status": "affected", "version": "All versions", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Moriel Harush, Dudu Moyal - Peer Security LTD"}], "datePublic": "2024-12-30T09:38:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')</span>"}], "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "shortName": "INCD", "dateUpdated": "2024-12-30T09:40:10.453Z"}, "references": [{"url": "https://www.gov.il/en/Departments/faq/cve_advisories"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">This FW version is EOL. Update to the latest FW version</span><br>"}], "value": "This FW version is EOL. Update to the latest FW version"}], "source": {"advisory": "ILVN-2024-0210", "discovery": "UNKNOWN"}, "title": "Mobotix - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-12-30T16:20:12.176310Z", "id": "CVE-2024-47917", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-30T16:20:48.446Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-47917", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-30T16:20:12.176310Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-30T16:20:42.713Z"}}], "cna": {"title": "Mobotix - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "source": {"advisory": "ILVN-2024-0210", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Moriel Harush, Dudu Moyal - Peer Security LTD"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mobotix", "product": "CCTV FW", "versions": [{"status": "affected", "version": "All versions", "versionType": "custom", "lessThanOrEqual": "version MX-V3.4.2.16"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "This FW version is EOL. Update to the latest FW version", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">This FW version is EOL. Update to the latest FW version</span><br>", "base64": false}]}], "datePublic": "2024-12-30T09:38:00.000Z", "references": [{"url": "https://www.gov.il/en/Departments/faq/cve_advisories"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "shortName": "INCD", "dateUpdated": "2024-12-30T09:40:10.453Z"}}}, "cveMetadata": {"cveId": "CVE-2024-47917", "state": "PUBLISHED", "dateUpdated": "2024-12-30T16:20:48.446Z", "dateReserved": "2024-10-06T07:19:12.342Z", "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "datePublished": "2024-12-30T09:40:10.453Z", "assignerShortName": "INCD"}, "dataVersion": "5.1"}