CVE-2024-3776 MEDIUM

CVE-2024-3776: Netvision airPASS - Reflected XSS

Vendor Netvision

Product airPASS

Weakness CWE-79 · XSS

Published April 15, 2024

Last update August 1, 2024

View on NVD All CVEs

CVSS base score

6.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

The parameter used in the login page of Netvision airPASS is not properly filtered for user input. An unauthenticated remote attacker can insert JavaScript code to the parameter for Reflected Cross-site scripting attacks.

Key dates

02Disclosure timeline

April 15, 2024 CVE published

August 1, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-3776 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-2975 GFI KerioConnect Signature EditHtmlSource cross site scripting CVE-2024-54265 WordPress Barcode Scanner and Inventory manager plugin <= 1.6.6 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2022-42466 XSS vulnerability, eg for String properties. CVE-2023-0867 Multiple stored and reflected Cross-site Scripting in webapp CVE-2025-30634 WordPress WP Featured Content Slider plugin <= 2.6 - Cross Site Scripting (XSS) Vulnerability