{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-28142", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "state": "PUBLISHED", "assignerShortName": "SEC-VLab", "dateReserved": "2024-03-05T09:15:40.202Z", "datePublished": "2024-12-12T12:35:15.731Z", "dateUpdated": "2025-11-03T21:54:26.598Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Scan2Net", "vendor": "Image Access GmbH", "versions": [{"changes": [{"at": "7.40", "status": "unaffected"}], "lessThan": "7.40", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Daniel Hirschberger (SEC Consult Vulnerability Lab)"}, {"lang": "en", "type": "finder", "value": "Tobias Niemann (SEC Consult Vulnerability Lab)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div><div><div><div><p>Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The \"File Name\" page (<span style=\"background-color: rgb(255, 255, 255);\">/cgi/uset.cgi?-cfilename) in the User Settings menu improperly filters the \"file name\" and wildcard character input field. By exploiting the wildcard character feature, attackers are able to store arbitrary Javascript code which is being triggered if the page is viewed afterwards, e.g. by higher privileged users such as admins.</span></p></div></div></div></div><div><div><span style=\"background-color: rgb(255, 255, 255);\">This attack can even be performed without being logged in because the affected functions are not fully protected. Without logging in, only the file name parameter of the \"Default\" User can be changed.</span><br></div></div><br>"}], "value": "Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The \"File Name\" page (/cgi/uset.cgi?-cfilename) in the User Settings menu improperly filters the \"file name\" and wildcard character input field. By exploiting the wildcard character feature, attackers are able to store arbitrary Javascript code which is being triggered if the page is viewed afterwards, e.g. by higher privileged users such as admins.\n\n\n\n\n\n\n\n\n\nThis attack can even be performed without being logged in because the affected functions are not fully protected. Without logging in, only the file name parameter of the \"Default\" User can be changed."}], "exploits": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The SEC Consult Vulnerability Lab has published proof of concept material in the technical security advisory.<br>"}], "value": "The SEC Consult Vulnerability Lab has published proof of concept material in the technical security advisory."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2024-12-12T12:35:15.731Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://r.sec-consult.com/imageaccess"}, {"tags": ["patch"], "url": "https://www.imageaccess.de/?page=SupportPortal&lang=en"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">The vendor provides a firmware update to version 7.40 (or higher) which can be downloaded via the vendor's customer server portal.</span><br>"}], "value": "The vendor provides a firmware update to version 7.40 (or higher) which can be downloaded via the vendor's customer server portal."}], "source": {"discovery": "UNKNOWN"}, "title": "Stored cross site scripting", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-12-12T15:26:12.258053Z", "id": "CVE-2024-28142", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-12T15:29:48.542Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://seclists.org/fulldisclosure/2024/Dec/2"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:54:26.598Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://seclists.org/fulldisclosure/2024/Dec/2"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:54:26.598Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-28142", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-12T15:26:12.258053Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-12T15:27:11.085Z"}}], "cna": {"title": "Stored cross site scripting", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Daniel Hirschberger (SEC Consult Vulnerability Lab)"}, {"lang": "en", "type": "finder", "value": "Tobias Niemann (SEC Consult Vulnerability Lab)"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"vendor": "Image Access GmbH", "product": "Scan2Net", "versions": [{"status": "affected", "changes": [{"at": "7.40", "status": "unaffected"}], "version": "0", "lessThan": "7.40", "versionType": "custom"}], "defaultStatus": "affected"}], "exploits": [{"lang": "en", "value": "The SEC Consult Vulnerability Lab has published proof of concept material in the technical security advisory.", "supportingMedia": [{"type": "text/html", "value": "The SEC Consult Vulnerability Lab has published proof of concept material in the technical security advisory.<br>", "base64": false}]}], "solutions": [{"lang": "en", "value": "The vendor provides a firmware update to version 7.40 (or higher) which can be downloaded via the vendor's customer server portal.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">The vendor provides a firmware update to version 7.40 (or higher) which can be downloaded via the vendor's customer server portal.</span><br>", "base64": false}]}], "references": [{"url": "https://r.sec-consult.com/imageaccess", "tags": ["third-party-advisory"]}, {"url": "https://www.imageaccess.de/?page=SupportPortal&lang=en", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The \"File Name\" page (/cgi/uset.cgi?-cfilename) in the User Settings menu improperly filters the \"file name\" and wildcard character input field. By exploiting the wildcard character feature, attackers are able to store arbitrary Javascript code which is being triggered if the page is viewed afterwards, e.g. by higher privileged users such as admins.\n\n\n\n\n\n\n\n\n\nThis attack can even be performed without being logged in because the affected functions are not fully protected. Without logging in, only the file name parameter of the \"Default\" User can be changed.", "supportingMedia": [{"type": "text/html", "value": "<div><div><div><div><p>Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The \"File Name\" page (<span style=\"background-color: rgb(255, 255, 255);\">/cgi/uset.cgi?-cfilename) in the User Settings menu improperly filters the \"file name\" and wildcard character input field. By exploiting the wildcard character feature, attackers are able to store arbitrary Javascript code which is being triggered if the page is viewed afterwards, e.g. by higher privileged users such as admins.</span></p></div></div></div></div><div><div><span style=\"background-color: rgb(255, 255, 255);\">This attack can even be performed without being logged in because the affected functions are not fully protected. Without logging in, only the file name parameter of the \"Default\" User can be changed.</span><br></div></div><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2024-12-12T12:35:15.731Z"}}}, "cveMetadata": {"cveId": "CVE-2024-28142", "state": "PUBLISHED", "dateUpdated": "2025-11-03T21:54:26.598Z", "dateReserved": "2024-03-05T09:15:40.202Z", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "datePublished": "2024-12-12T12:35:15.731Z", "assignerShortName": "SEC-VLab"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The \"File Name\" page (/cgi/uset.cgi?-cfilename) in the User Settings menu improperly filters the \"file name\" and wildcard character input field. By exploiting the wildcard character feature, attackers are able to store arbitrary Javascript code which is being triggered if the page is viewed afterwards, e.g. by higher privileged users such as admins.\n\n\n\n\n\n\n\n\n\nThis attack can even be performed without being logged in because the affected functions are not fully protected. Without logging in, only the file name parameter of the \"Default\" User can be changed."}, {"lang": "es", "value": "Debido a la falta de desinfecci\u00f3n de entrada, un atacante puede realizar ataques cross-site-scripting y ejecutar c\u00f3digo Javascript arbitrario en el navegador de otros usuarios. La p\u00e1gina \"Nombre de archivo\" (/cgi/uset.cgi?-cfilename) en el men\u00fa Configuraci\u00f3n de usuario filtra incorrectamente el campo de entrada de \"nombre de archivo\" y el car\u00e1cter comod\u00edn. Al explotar la funci\u00f3n de car\u00e1cter comod\u00edn, los atacantes pueden almacenar c\u00f3digo Javascript arbitrario que se activa si la p\u00e1gina se ve posteriormente, por ejemplo, por usuarios con privilegios superiores, como los administradores. Este ataque puede incluso realizarse sin iniciar sesi\u00f3n porque las funciones afectadas no est\u00e1n completamente protegidas. Sin iniciar sesi\u00f3n, solo se puede cambiar el par\u00e1metro de nombre de archivo del usuario \"Predeterminado\"."}], "id": "CVE-2024-28142", "lastModified": "2025-11-03T22:16:50.053", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-12-12T13:15:09.763", "references": [{"source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "url": "https://r.sec-consult.com/imageaccess"}, {"source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "url": "https://www.imageaccess.de/?page=SupportPortal&lang=en"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2024/Dec/2"}], "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "type": "Secondary"}]}

{}