CVE-2024-47947

Summary

CVE-2024-47947: A cross-site scripting (XSS) vulnerability has been discovered in the "Edit Disclaimer Text" function of a configuration menu. This issue arises due to insufficient input sanitization. The attacker can inject malicious Javascript code and execute it in the browsers of other users. The function is only accessible to Poweruser and Admin users via the URL <https://$SCANNER/cgi/admin.cgi?-rdisclaimer+-apre>. The stored XSS payload will run each time the ScanWizard is loaded, including in kiosk-mode browsers.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.