CVE-2023-24496

Description

Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger these vulnerabilities.This XSS is exploited through the name field of the database.

Reserved 2023-01-24 | Published 2023-07-06 | Updated 2024-10-28 | Assigner talos

Problem types

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Product status

v2.0.2
affected

Credits

Discovered by Francesco Benvenuto of Cisco Talos.

References

talosintelligence.com/vulnerability_reports/TALOS-2023-1704

cve.org (CVE-2023-24496)

nvd.nist.gov (CVE-2023-24496)

Download JSON