CVE-2024-25155
CVSS 3.1 Score 7.2 of 10 (high)
Details
Summary
CVE-2024-25155 is a vulnerability found in FileCatalyst Direct versions 3.8.8 and earlier, through 3.8.6, where the web server fails to properly sanitize illegal characters in a URL, leading to the execution of arbitrary code within an HTML script tag on a subsequent error page. This vulnerability, categorized as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), has a high base severity rating of 7.2 according to the CVSS score. The potential danger to an organization includes the risk of unauthorized code execution and potential exploitation by malicious actors. To remediate this vulnerability, organizations should update FileCatalyst Direct to version 3.8.9 or later, which addresses the issue and enhances web server security measures.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions