CVE-2024-51860

Summary

CVE-2024-51860 is a Cross-site Scripting (XSS) vulnerability affecting the DuoGeek Custom Dashboard Widget. The flaw, which allows Stored XSS attacks, resides in the widget's input neutralization process during web page generation. An attacker could exploit this vulnerability by injecting malicious scripts into the widget, potentially stealing sensitive user information or taking control of their sessions. The issue spans from the earliest version (n/a) up to and including 1.0.0. Users are strongly advised to update their widget to the latest, secure version as soon as possible.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.