CVE-2024-23862
CVSS 3.1 Score 6.1 of 10 (medium)
Details
Summary
CVE-2024-23862 is a vulnerability found in Cups Easy (Purchase & Inventory) version 1.0. It is categorized as a Cross-Site Scripting (XSS) vulnerability, where user-controlled inputs are not properly encoded in the grnno parameter of the /cupseasylive/grndisplay.php page. This vulnerability allows a remote attacker to send a specially crafted URL to an authenticated user and potentially steal their session cookie credentials. The base severity of this vulnerability is rated as MEDIUM (base score of 6.1) with low impacts on integrity and confidentiality. The attack vector is through the network and user interaction is required. No privileges are required for exploitation, and the attack complexity is low. Remediation measures should be taken to ensure that user input is properly encoded to prevent XSS attacks.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions