Skip to content
CVE PROGRAM SOURCE RECORD4.8 Medium

CVE-2024-8457

PLANET Technology switch devices - Stored cross-site scripting (XSS) in the User Management

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
twcert

Description

Certain switch models from PLANET Technology have a web application that does not properly validate specific parameters, allowing remote authenticated users with administrator privileges to inject arbitrary JavaScript, leading to Stored XSS attack.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PLANET Technology GS-4210-24PL4C hardware 2.0

Default version status: unaffected

  • 0 to < 2.305b240719affected

PLANET Technology GS-4210-24P2S hardware 3.0

Default version status: unaffected

  • 0 to < 3.305b240802affected

References