Lucene search
HistoryJul 15, 2024 - 2:15 p.m.
CVE-2024-38493
reflected cross-site scripting
pam ui web interface
remote attacker
CVSS3
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
17.7%
A reflected cross-site scripting (XSS) vulnerability exists in the PAM UI web interface. A remote attacker able to convince a PAM user to click on a specially crafted link to the PAM UI web interface could potentially execute arbitrary client-side code in the context of PAM UI.
Affected configurations
Node
broadcomsymantec_privileged_access_managementRange4.1.0–4.1.7
| Vendor | Product | Version | CPE |
|---|---|---|---|
| broadcom | symantec_privileged_access_management | * | cpe:2.3:a:broadcom:symantec_privileged_access_management:*:*:*:*:*:*:*:* |
CVSS3
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
17.7%
Related for NVD:CVE-2024-38493