{"id":"CVE-2024-12021","state":"PUBLISHED","title":"Stored Cross-Site Scripting","description":"Coverity versions prior to 2024.9.0 are vulnerable to stored cross-site scripting (XSS) in various administrative interfaces. The impact of exploitation may result in the compromise of local accounts managed by the Coverity platform as well as other standard impacts resulting from cross-site scripting.","publishedAt":"2025-03-31T14:00:20.216Z","updatedAt":"2025-03-31T15:13:06.890Z","severity":{"score":8.5,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","source":"BlackDuck"},"assigner":"BlackDuck","products":["Black Duck Coverity"],"affected":[{"vendor":"Black Duck","product":"Coverity","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2024.9.0","versionType":"custom"}],"platforms":["Windows","MacOS","Linux"]}],"references":["https://community.blackduck.com/s/article/Black-Duck-Product-Security-Advisory-CVE-2024-12021"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:06:50.777Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/12xxx/CVE-2024-12021.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-12021","state":"PUBLISHED","datePublished":"2025-03-31T14:00:20.216Z","dateUpdated":"2025-03-31T15:13:06.890Z","assignerShortName":"BlackDuck","assignerOrgId":"8cad7728-009c-4a3d-a95e-ca62e6ff8a0b","dateReserved":"2024-12-02T14:24:56.859Z"},"containers":{"cna":{"title":"Stored Cross-Site Scripting","descriptions":[{"lang":"en","value":"Coverity versions prior to 2024.9.0 are vulnerable to stored cross-site scripting (XSS) in various administrative interfaces. The impact of exploitation may result in the compromise of local accounts managed by the Coverity platform as well as other standard impacts resulting from cross-site scripting."}],"affected":[{"vendor":"Black Duck","product":"Coverity","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2024.9.0","versionType":"custom"}],"platforms":["Windows","MacOS","Linux"]}],"references":[{"url":"https://community.blackduck.com/s/article/Black-Duck-Product-Security-Advisory-CVE-2024-12021","tags":["vendor-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.5,"baseSeverity":"HIGH","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"BlackDuck","orgId":"8cad7728-009c-4a3d-a95e-ca62e6ff8a0b","dateUpdated":"2025-03-31T14:00:20.216Z"},"credits":[{"lang":"en","type":"finder","value":"Jozef Frantisek Stefanovic"}],"datePublic":"2025-03-31T14:00:00.000Z","impacts":[{"capecId":"CAPEC-592","descriptions":[{"lang":"en","value":"CAPEC-592 Stored XSS"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Upgrade the Coverity Platform version to 2024.9.0 at a minimum."}],"value":"Upgrade the Coverity Platform version to 2024.9.0 at a minimum."}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-03-31T15:11:30.538255Z","id":"CVE-2024-12021","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-31T15:13:06.890Z"}}]}}}