CVE-2024-37776
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability in Sunbird DCIM dcTrack v9.1.2 allows attackers to inject malicious scripts or HTML on certain admin screens.
Risk Assessment
The risk includes potential session hijacking of administrators, data theft, or unauthorized actions within the data center infrastructure management system.
Recommendation
Immediately update Sunbird DCIM dcTrack to the latest available version that fixes this vulnerability. Until then, restrict admin panel access to trusted users only.
Other vulnerabilities in Sunbird DCIM dcTrack
See all- CVE-2024-37775High
In Sunbird DCIM dcTrack version 9.1.2, incorrect access control allows attackers to create or update tickets with a location that bypasses an RBAC check.
- CVE-2024-37774High
A CSRF vulnerability in Sunbird DCIM dcTrack version 9.1.2 allows authenticated attackers to escalate privileges by forcing an administrator to perform sensitive requests on certain admin screens.
- CVE-2024-37773Medium
An HTML injection vulnerability in Sunbird DCIM dcTrack 9.1.2 allows authenticated attackers with administrator privileges to inject arbitrary HTML code in an admin screen.
Original NVD description (English source)
A cross-site scripting (XSS) vulnerability in Sunbird DCIM dcTrack v9.1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in some admin screens.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS