CVE-2024-8528 - Vulnerability Details - OpenCVE

Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not being sanitized.

Attack Vector Local

Attack Complexity High

Privileges Required Low

Attack Requirements Present

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact Low

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

These vulnerabilities have been remediated in cumulative releases for versions 8.0, 8.5, and 9.0. Please be aware that WebCTRL and i-Vu versions 7.0, 6.5, and 6.1 are no longer supported. To safeguard against these vulnerabilities, upgrading to the latest WebCTRL and i-Vu software is strongly recommended.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.corporate.carrier.com/product-security/advisories-resources/

History

Wed, 19 Nov 2025 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 19 Nov 2025 13:30:00 +0000

Type	Values Removed	Values Added
Description		Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not being sanitized.
Title		ALC WebCTRL Carrier i-Vu Reflected XSS due to unsanitized parameter
Weaknesses		CWE-79
References		https://www.corporate.carrier.com/product-security/advisories-resources/
Metrics		cvssV4_0 `{'score': 5.4, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L'}`

MITRE

Status: PUBLISHED

Assigner: Carrier

Published: 2025-11-19T13:18:35.293Z

Updated: 2025-11-19T15:15:57.698Z

Reserved: 2024-09-06T16:01:34.807Z

Link: CVE-2024-8528

Vulnrichment

Updated: 2025-11-19T15:15:10.301Z

NVD

Status : Awaiting Analysis

Published: 2025-11-19T14:15:57.780

Modified: 2025-11-19T19:14:59.327

Link: CVE-2024-8528

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-8528", "assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f", "state": "PUBLISHED", "assignerShortName": "Carrier", "dateReserved": "2024-09-06T16:01:34.807Z", "datePublished": "2025-11-19T13:18:35.293Z", "dateUpdated": "2025-11-19T15:15:57.698Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "WebCtrl", "vendor": "Automated Logic", "versions": [{"lessThanOrEqual": "9.0", "status": "affected", "version": "6.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "i-Vu", "vendor": "Carrier", "versions": [{"lessThanOrEqual": "9.0", "status": "affected", "version": "6.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Jaryl Low"}, {"lang": "en", "type": "finder", "value": "Thuy D. Nguyen"}, {"lang": "en", "type": "finder", "value": "Cynthia E. Irvine"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not being sanitized."}], "value": "Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not being sanitized."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "baseScore": 5.4, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f", "shortName": "Carrier", "dateUpdated": "2025-11-19T13:18:35.293Z"}, "references": [{"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "These\nvulnerabilities have been remediated in cumulative releases for versions 8.0,\n8.5, and 9.0. Please be aware that WebCTRL and i-Vu versions 7.0, 6.5, and 6.1 are no longer supported. To\nsafeguard against these vulnerabilities, upgrading to the latest WebCTRL and i-Vu software is strongly recommended. \n\n\n\n<br>"}], "value": "These\nvulnerabilities have been remediated in cumulative releases for versions 8.0,\n8.5, and 9.0. Please be aware that WebCTRL and i-Vu versions 7.0, 6.5, and 6.1 are no longer supported. To\nsafeguard against these vulnerabilities, upgrading to the latest WebCTRL and i-Vu software is strongly recommended."}], "source": {"discovery": "UNKNOWN"}, "title": "ALC WebCTRL Carrier i-Vu Reflected XSS due to unsanitized parameter", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-19T15:13:38.562324Z", "id": "CVE-2024-8528", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-19T15:15:57.698Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-8528", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-19T15:13:38.562324Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-19T15:15:10.301Z"}}], "cna": {"title": "ALC WebCTRL Carrier i-Vu Reflected XSS due to unsanitized parameter", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Jaryl Low"}, {"lang": "en", "type": "finder", "value": "Thuy D. Nguyen"}, {"lang": "en", "type": "finder", "value": "Cynthia E. Irvine"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Automated Logic", "product": "WebCtrl", "versions": [{"status": "affected", "version": "6.0", "versionType": "semver", "lessThanOrEqual": "9.0"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}, {"vendor": "Carrier", "product": "i-Vu", "versions": [{"status": "affected", "version": "6.0", "versionType": "semver", "lessThanOrEqual": "9.0"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "These\nvulnerabilities have been remediated in cumulative releases for versions 8.0,\n8.5, and 9.0. Please be aware that WebCTRL and i-Vu versions 7.0, 6.5, and 6.1 are no longer supported. To\nsafeguard against these vulnerabilities, upgrading to the latest WebCTRL and i-Vu software is strongly recommended.", "supportingMedia": [{"type": "text/html", "value": "These\nvulnerabilities have been remediated in cumulative releases for versions 8.0,\n8.5, and 9.0. Please be aware that WebCTRL and i-Vu versions 7.0, 6.5, and 6.1 are no longer supported. To\nsafeguard against these vulnerabilities, upgrading to the latest WebCTRL and i-Vu software is strongly recommended. \n\n\n\n<br>", "base64": false}]}], "references": [{"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not being sanitized.", "supportingMedia": [{"type": "text/html", "value": "Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not being sanitized.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f", "shortName": "Carrier", "dateUpdated": "2025-11-19T13:18:35.293Z"}}}, "cveMetadata": {"cveId": "CVE-2024-8528", "state": "PUBLISHED", "dateUpdated": "2025-11-19T15:15:57.698Z", "dateReserved": "2024-09-06T16:01:34.807Z", "assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f", "datePublished": "2025-11-19T13:18:35.293Z", "assignerShortName": "Carrier"}, "dataVersion": "5.2"}