PT-2024-36031

CVE-2024-5410

Published

2024-05-28

Updated

2025-02-26

Description by

CVSS 4.0

8.3

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:H/SC:N/SI:N/SA:H

Name of the Vulnerable Software and Affected Versions IAP-420 versions 2.01e and below

Description The issue is related to missing input validation in the ORing IAP-420 web-interface, which allows stored Cross-Site Scripting (XSS). This problem is being actively exploited.

Recommendations For IAP-420 versions 2.01e and below, update to a version above 2.01e to resolve the issue. As a temporary workaround, consider restricting access to the web-interface to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

T. Weber

Thomas Weber

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers