CVE-2024-24397
MediumCVSS 5.4Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A Cross Site Scripting (XSS) vulnerability in Stimulsoft Dashboard.JS before version 2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload in the ReportName field.
Risk Assessment
An attacker can exploit this vulnerability to steal user sessions, take over accounts, or spread malware within the organization.
Recommendation
Immediately update Stimulsoft Dashboard.JS to version 2024.1.2 or later and apply input filtering on the ReportName field.
Other vulnerabilities in Stimulsoft Dashboard.JS
See all- CVE-2024-24398Critical
A Directory Traversal vulnerability in Stimulsoft Dashboard.JS before version 2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload in the fileName parameter of the Save function.
- CVE-2024-24396Medium
A Cross Site Scripting (XSS) vulnerability in Stimulsoft Dashboard.JS before version 2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload in the search bar component.
Original NVD description (English source)
Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the ReportName field.