CVE-2024-23892

CVSS 3.1 Score 8.2 of 10 (high)

Details

Published Jan 26, 2024
Updated: Feb 15, 2024
CWE ID 79

Summary

CVE-2024-23892 is a vulnerability in Cups Easy (Purchase & Inventory) version 1.0. The vulnerability allows for user-controlled inputs to be improperly encoded, resulting in a Cross-Site Scripting (XSS) vulnerability in the costcenterid parameter of /cupseasylive/costcentercreate.php. This can be exploited by a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials. The base severity of this vulnerability is rated as HIGH, with a base score of 8.2 according to CVSS:3.1. The impact includes high confidentiality impact and low integrity impact, while the attack vector is through the network and user interaction is required. Remediation for this vulnerability is not provided in the given information.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-23892 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options