CVE-2024-44793

Summary

CVE-2024-44793 is a cross-site scripting (XSS) vulnerability affecting the Gazelle platform, specifically in the component located at /managers/multiple_freeleech.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the torrents parameter, posing a potential risk of unauthorized actions on user sessions. The exploit requires user interaction and has a medium severity rating with an exploitability score of 2.8, indicating that while it does not require elevated privileges, it can compromise user integrity and confidentiality to some extent. Organizations using Gazelle should remediate this issue by applying security patches or updates as they become available and sanitizing user inputs to prevent script execution. Failure to address this vulnerability could lead to data breaches or unauthorized actions within the application environment.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.