CVE-2024-2391

Name of the Vulnerable Software and Affected Versions EVE-NG versions 5.0.1-13

Description The issue exists due to the lack of protection of the web page structure in the Lab Handler component of EVE-NG, allowing a remote attacker to conduct a cross-site scripting (XSS) attack. The manipulation of some unknown functionality of the Lab Handler component leads to this issue. The attack may be launched remotely.

Recommendations For EVE-NG versions 5.0.1-13, consider disabling the Lab Handler component until a patch is available to prevent potential cross-site scripting attacks. Restrict access to the affected component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.