CVE-2024-36494

Description

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The login page at /cgi/slogin.cgi suffers from XSS due to improper input filtering of the -tsetup+-uuser parameter, which can only be exploited if the target user is not already logged in. This makes it ideal for login form phishing attempts.

Reserved 2024-05-29 | Published 2024-12-12 | Updated 2024-12-12 | Assigner SEC-VLab

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

Default status
affected

Any version before 7.42B
affected

Credits

Daniel Hirschberger (SEC Consult Vulnerability Lab) finder

Tobias Niemann (SEC Consult Vulnerability Lab) finder

References

r.sec-consult.com/imageaccess third-party-advisory

www.imageaccess.de/?page=SupportPortal&lang=en patch

cve.org (CVE-2024-36494)

nvd.nist.gov (CVE-2024-36494)

Download JSON