CVE-2024-38493 MEDIUM

CVE-2024-38493: Symantec Privileged Access Manager Reflected Cross Site Scripting vulnerability

Vendor Broadcom
Product Symantec Privileged Access Management
Published July 15, 2024
Last update October 27, 2024
View on NVD All CVEs

CVSS base score

6.8/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:L/SA:L

What the vulnerability does

01Description

A reflected cross-site scripting (XSS) vulnerability exists in the PAM UI web interface. A remote attacker able to convince a PAM user to click on a specially crafted link to the PAM UI web interface could potentially execute arbitrary client-side code in the context of PAM UI.

Key dates

02Disclosure timeline

July 15, 2024 CVE published
October 27, 2024 Record updated