CVE-2024-42852

MEDIUMNuclei

Micro Focus acutoweb Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2024-42852 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Cross Site Scripting vulnerability in AcuToWeb server v.10.5.0.7577C8b allows a remote attacker to execute arbitrary code via the index.php component.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Aug 7, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 23, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

acutoweb

Browse Micro Focus / acutoweb

Default status: unknown

VulnCheck, CVE List10.5.0.7577C8baffected

Nuclei templates

1
ProjectDiscoveryMEDIUMAcuToWeb server/10.5.0.7577c8b - Cross-Site ScriptingCVSS 6.1

AcuToWeb server/10.5.0.7577c8b is vulnerable to reflected cross-site scripting (XSS) via the portgw parameter. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.

Impact

Successful exploitation of this XSS vulnerability allows attackers to execute arbitrary JavaScript code in victims' browsers, potentially leading to session hijacking, credential theft, or other malicious activities.

Remediation

Update AcuToWeb to the latest version. Implement proper input validation and output encoding for all user-supplied data, especially the portgw parameter.

WeaknessesCWE-79
Authorsritikchaddha
Template tagscvecve2024xssacutowebopentextvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:opentext:acutoweb:10.5.0.7577c8b:*:*:*:*:*:*:*
Shodan: title:"AcuToWeb"
FOFA: title="AcuToWeb"
https://github.com/Hebing123/cve/issues/64 https://nvd.nist.gov/vuln/detail/CVE-2024-42852

Source: ProjectDiscovery

References

2