CVE-2024-50800

Name of the Vulnerable Software and Affected Versions: M2000 Smart4Web versions prior to 5.020241004

Description: The issue allows a remote attacker to execute arbitrary code via the error parameter in the URL. This is a Cross Site Scripting vulnerability, which can lead to the execution of arbitrary code.

Recommendations: For versions prior to 5.020241004, update to version 5.020241004 or later to resolve the issue. As a temporary workaround, consider restricting access to the URL endpoint that accepts the error parameter until a patch is available. Avoid using the error parameter in the affected URL endpoint until the issue is resolved.