CVE-2024-44795
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability in the /login/disabled.php component of Gazelle (commit 63b3370) allows attackers to inject arbitrary web scripts or HTML via the username parameter.
Risk Assessment
Attackers can steal user sessions, redirect users to malicious sites, or perform other unauthorized actions in the victim's browser context.
Recommendation
Update Gazelle to the latest patched version and implement input validation and encoding for the username parameter.
Other vulnerabilities in Gazelle
See all- CVE-2024-44797Medium
A cross-site scripting (XSS) vulnerability in the /managers/enable_requests.php component of Gazelle (commit 63b3370) allows attackers to inject arbitrary scripts or HTML via the view parameter. This can lead to arbitrary JavaScript execution in the victim's browser.
- CVE-2024-44793Medium
An XSS vulnerability in the /managers/multiple_freeleech.php component of Gazelle (commit 63b3370) allows attackers to inject malicious scripts or HTML via the torrents parameter.
Original NVD description (English source)
A cross-site scripting (XSS) vulnerability in the component /login/disabled.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS