Skip to content
CVE PROGRAM SOURCE RECORD4.7 Medium

CVE-2023-24496

Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-crafted HTTP request can lead to arbitra

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
talos

Description

Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger these vulnerabilities.This XSS is exploited through the name field of the database.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Milesight MilesightVPN

  • v2.0.2affected

References