Lucene search

INCIBECVE-2024-0317

HistoryJan 15, 2024 - 5:15 p.m.

CVE-2024-0317

2024-01-1517:15:08

CWE-79

INCIBE

web.nvd.nist.gov

cve-2024-0317

cross-site scripting

fireeye ex

vulnerability

exploitation

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

17.0%

JSON

Cross-Site Scripting in FireEye EX, affecting version 9.0.3.936727. Exploitation of this vulnerability allows an attacker to send a specially crafted JavaScript payload via the ‘type’ and ‘s_f_name’ parameters to an authenticated user to retrieve their session details.

Affected configurations

Nvd

Vulners

Node

fireeyeex_5500_firmwareaMatch9.0.3.936727

AND

fireeyeex_5500Match-

Node

fireeyeex_8500_firmwareMatch9.0.3.936727

AND

fireeyeex_8500Match-

Node

fireeyeex_3500_firmwareMatch9.0.3.936727

AND

fireeyeex_3500Match-

VendorProductVersionCPE
fireeyeex_5500_firmwarea9.0.3.936727cpe:2.3:o:fireeye:ex_5500_firmwarea:9.0.3.936727:*:*:*:*:*:*:*
fireeyeex_5500-cpe:2.3:h:fireeye:ex_5500:-:*:*:*:*:*:*:*
fireeyeex_8500_firmware9.0.3.936727cpe:2.3:o:fireeye:ex_8500_firmware:9.0.3.936727:*:*:*:*:*:*:*
fireeyeex_8500-cpe:2.3:h:fireeye:ex_8500:-:*:*:*:*:*:*:*
fireeyeex_3500_firmware9.0.3.936727cpe:2.3:o:fireeye:ex_3500_firmware:9.0.3.936727:*:*:*:*:*:*:*
fireeyeex_3500-cpe:2.3:h:fireeye:ex_3500:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fireeye	ex_5500_firmwarea	9.0.3.936727	cpe:2.3:o:fireeye:ex_5500_firmwarea:9.0.3.936727:::::::*
fireeye	ex_5500	-	cpe:2.3:h:fireeye:ex_5500:-:::::::*
fireeye	ex_8500_firmware	9.0.3.936727	cpe:2.3:o:fireeye:ex_8500_firmware:9.0.3.936727:::::::*
fireeye	ex_8500	-	cpe:2.3:h:fireeye:ex_8500:-:::::::*
fireeye	ex_3500_firmware	9.0.3.936727	cpe:2.3:o:fireeye:ex_3500_firmware:9.0.3.936727:::::::*
fireeye	ex_3500	-	cpe:2.3:h:fireeye:ex_3500:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "FireEye EX",
    "vendor": "FireEye ",
    "versions": [
      {
        "status": "affected",
        "version": "9.0.3.936727"
      }
    ]
  }
]

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fireeye-products

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

17.0%

JSON

Related for CVE-2024-0317