CVE-2024-37773
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
An HTML injection vulnerability in Sunbird DCIM dcTrack 9.1.2 allows authenticated attackers with administrator privileges to inject arbitrary HTML code in an admin screen.
Risk Assessment
An attacker can alter the appearance of the admin panel, embed malicious content, or conduct phishing attacks against other administrators.
Recommendation
It is recommended to update to the latest version of Sunbird DCIM dcTrack and restrict access to the admin panel to trusted users only.
Other vulnerabilities in Sunbird DCIM dcTrack
See all- CVE-2024-37776Medium
A cross-site scripting (XSS) vulnerability in Sunbird DCIM dcTrack v9.1.2 allows attackers to inject malicious scripts or HTML on certain admin screens.
- CVE-2024-37775High
In Sunbird DCIM dcTrack version 9.1.2, incorrect access control allows attackers to create or update tickets with a location that bypasses an RBAC check.
- CVE-2024-37774High
A CSRF vulnerability in Sunbird DCIM dcTrack version 9.1.2 allows authenticated attackers to escalate privileges by forcing an administrator to perform sensitive requests on certain admin screens.
Original NVD description (English source)
An HTML injection vulnerability in Sunbird DCIM dcTrack 9.1.2 allows attackers authenticated as administrators to inject arbitrary HTML code in an admin screen.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS