CVE-2024-44795

MediumCVSS 6.1

Published: 26/08/2024(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability in the /login/disabled.php component of Gazelle (commit 63b3370) allows attackers to inject arbitrary web scripts or HTML via the username parameter.

Risk Assessment

Attackers can steal user sessions, redirect users to malicious sites, or perform other unauthorized actions in the victim's browser context.

Recommendation

Update Gazelle to the latest patched version and implement input validation and encoding for the username parameter.

Original NVD description (English source)

A cross-site scripting (XSS) vulnerability in the component /login/disabled.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter.