CVE-2024-50659
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A Cross Site Scripting (XSS) vulnerability in iPublish Media Solutions AdPortal 3.0.39 allows a remote attacker to escalate privileges via the shippingAsBilling parameter in updateuserinfo.html.
Risk Assessment
An attacker can exploit this vulnerability to execute a malicious script in the context of an administrator session, potentially leading to data theft, account takeover, or further privilege escalation within the system.
Recommendation
Immediately update AdPortal to the latest version that fixes this vulnerability and apply input filtering and validation for the shippingAsBilling parameter.
Original NVD description (English source)
Cross Site Scripting vulnerability iPublish Media Solutions AdPortal 3.0.39 allows a remote attacker to escalate privileges via the shippingAsBilling parameter in updateuserinfo.html.