CVE-2024-44797

MediumCVSS 6.1

Published: 26/08/2024(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

23th percentile - higher than 23% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability in the /managers/enable_requests.php component of Gazelle (commit 63b3370) allows attackers to inject arbitrary scripts or HTML via the view parameter. This can lead to arbitrary JavaScript execution in the victim's browser.

Risk Assessment

The risk includes session hijacking, account takeover, or unauthorized actions performed on behalf of the victim. This could result in data loss and confidentiality breaches for the organization.

Recommendation

Immediately update Gazelle to a patched version or apply input filtering on the view parameter. Additionally, implement a Content Security Policy (CSP) to mitigate XSS impact.

Original NVD description (English source)

A cross-site scripting (XSS) vulnerability in the component /managers/enable_requests.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the view parameter.