CVE-2024-3850 MEDIUM

CVE-2024-3850: Uniview NVR301-04S2-P4 Cross-site Scripting

Vendor Uniview
Product NVR301-04S2-P4
Weakness CWE-79 · XSS
Published June 10, 2024
Last update August 26, 2024

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack (XSS). An attacker could send a user a URL that if clicked on could execute malicious JavaScript in their browser. This vulnerability also requires authentication before it can be exploited, so the scope and severity is limited. Also, even if JavaScript is executed, no additional benefits are obtained.

Key dates

02Disclosure timeline

June 10, 2024 CVE published
August 26, 2024 Record updated

Related vulnerabilities

04Related CVE