CVE-2024-47917 - Vulnerability Details - OpenCVE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00112.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2024-42492	CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Fixes

Solution

This FW version is EOL. Update to the latest FW version

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.gov.il/en/Departments/faq/cve_advisories

History

Mon, 30 Dec 2024 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 30 Dec 2024 09:45:00 +0000

Type	Values Removed	Values Added
Description		CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Title		Mobotix - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Weaknesses		CWE-79
References		https://www.gov.il/en/Departments/faq/cve_advisories
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: INCD

Published: 2024-12-30T09:40:10.453Z

Updated: 2024-12-30T16:20:48.446Z

Reserved: 2024-10-06T07:19:12.342Z

Link: CVE-2024-47917

Vulnrichment

Updated: 2024-12-30T16:20:42.713Z

NVD

Status : Received

Published: 2024-12-30T10:15:06.067

Modified: 2024-12-30T10:15:06.067

Link: CVE-2024-47917

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-79

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-47917", "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "state": "PUBLISHED", "assignerShortName": "INCD", "dateReserved": "2024-10-06T07:19:12.342Z", "datePublished": "2024-12-30T09:40:10.453Z", "dateUpdated": "2024-12-30T16:20:48.446Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "CCTV FW", "vendor": "Mobotix", "versions": [{"lessThanOrEqual": "version MX-V3.4.2.16", "status": "affected", "version": "All versions", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Moriel Harush, Dudu Moyal - Peer Security LTD"}], "datePublic": "2024-12-30T09:38:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')</span>"}], "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "shortName": "INCD", "dateUpdated": "2024-12-30T09:40:10.453Z"}, "references": [{"url": "https://www.gov.il/en/Departments/faq/cve_advisories"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">This FW version is EOL. Update to the latest FW version</span><br>"}], "value": "This FW version is EOL. Update to the latest FW version"}], "source": {"advisory": "ILVN-2024-0210", "discovery": "UNKNOWN"}, "title": "Mobotix - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-12-30T16:20:12.176310Z", "id": "CVE-2024-47917", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-30T16:20:48.446Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-47917", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-30T16:20:12.176310Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-30T16:20:42.713Z"}}], "cna": {"title": "Mobotix - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "source": {"advisory": "ILVN-2024-0210", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Moriel Harush, Dudu Moyal - Peer Security LTD"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mobotix", "product": "CCTV FW", "versions": [{"status": "affected", "version": "All versions", "versionType": "custom", "lessThanOrEqual": "version MX-V3.4.2.16"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "This FW version is EOL. Update to the latest FW version", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">This FW version is EOL. Update to the latest FW version</span><br>", "base64": false}]}], "datePublic": "2024-12-30T09:38:00.000Z", "references": [{"url": "https://www.gov.il/en/Departments/faq/cve_advisories"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "shortName": "INCD", "dateUpdated": "2024-12-30T09:40:10.453Z"}}}, "cveMetadata": {"cveId": "CVE-2024-47917", "state": "PUBLISHED", "dateUpdated": "2024-12-30T16:20:48.446Z", "dateReserved": "2024-10-06T07:19:12.342Z", "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "datePublished": "2024-12-30T09:40:10.453Z", "assignerShortName": "INCD"}, "dataVersion": "5.1"}