CVE-2024-8457 MEDIUM

CVE-2024-8457: PLANET Technology switch devices - Stored cross-site scripting (XSS) in the User Management

Vendor Planet Technology
Product GS-4210-24PL4C hardware 2.0
Weakness CWE-79 · XSS
Published September 30, 2024
Last update September 30, 2024
View on NVD All CVEs

CVSS base score

4.8/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Certain switch models from PLANET Technology have a web application that does not properly validate specific parameters, allowing remote authenticated users with administrator privileges to inject arbitrary JavaScript, leading to Stored XSS attack.

Key dates

02Disclosure timeline

September 30, 2024 CVE published
September 30, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2022-44628 WordPress 4ECPS Web Forms plugin <= 0.2.17 - Auth. Stored Cross-Site Scripting (XSS) vulnerability CVE-2023-41729 WordPress SendPress Newsletters Plugin <= 1.22.3.31 is vulnerable to Cross Site Scripting (XSS) CVE-2021-26256 WordPress Survey Maker plugin <= 2.0.6 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability CVE-2022-0256 Cross-site Scripting (XSS) - Stored in pimcore/pimcore CVE-2024-43988 WordPress Mystique theme <= 2.5.7 - Cross Site Scripting (XSS) vulnerability