{"id":"CVE-2024-3776","state":"PUBLISHED","title":"Netvision airPASS - Reflected XSS","description":"The parameter used in the login page of Netvision airPASS is not properly filtered for user input. An unauthenticated remote attacker can insert JavaScript code to the parameter for Reflected Cross-site scripting attacks.","publishedAt":"2024-04-15T02:58:41.818Z","updatedAt":"2024-08-01T20:20:02.489Z","severity":{"score":6.1,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","source":"twcert"},"assigner":"twcert","products":["Netvision airPASS "],"affected":[{"vendor":"Netvision","product":"airPASS ","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"v2.9.0.20231006","versionType":"custom"}]}],"references":["https://www.twcert.org.tw/tw/cp-132-7730-584e3-1.html"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:07:39.287Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/3xxx/CVE-2024-3776.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-3776","state":"PUBLISHED","datePublished":"2024-04-15T02:58:41.818Z","dateUpdated":"2024-08-01T20:20:02.489Z","assignerShortName":"twcert","assignerOrgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateReserved":"2024-04-15T02:44:17.283Z"},"containers":{"cna":{"title":"Netvision airPASS - Reflected XSS","descriptions":[{"lang":"en","value":"The parameter used in the login page of Netvision airPASS is not properly filtered for user input. An unauthenticated remote attacker can insert JavaScript code to the parameter for Reflected Cross-site scripting attacks."}],"affected":[{"vendor":"Netvision","product":"airPASS ","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"v2.9.0.20231006","versionType":"custom"}]}],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-7730-584e3-1.html","tags":["third-party-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"twcert","orgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateUpdated":"2024-04-15T02:58:41.818Z"},"datePublic":"2024-04-15T02:55:00.000Z","impacts":[{"capecId":"CAPEC-591","descriptions":[{"lang":"en","value":"CAPEC-591 Reflected XSS"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update to 2.9.0.231006 or later version."}],"value":"Update to 2.9.0.231006 or later version."}],"source":{"advisory":"TVN-202404003","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-3776","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-05-07T18:08:19.301875Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T17:32:46.367Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.twcert.org.tw/tw/cp-132-7730-584e3-1.html","tags":["third-party-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T20:20:02.489Z"}}]}}}