CVE-2024-52882

MEDIUM

AudioCodes One Voice Operations Center < 8.4.582 - Cross-Site Scripting via Devices API

Title source: llm
STIX 2.1

Description

An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to improper neutralization of input via the devices API, an attacker can inject malicious JavaScript code (XSS) to attack logged-in administrator sessions.

References (2)

Core 2

Scores

CVSS v3 6.1
EPSS 0.0023
EPSS Percentile 13.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
audiocodes/one_voice_operations_center < 8.4.582
Published Feb 07, 2025
Tracked Since Feb 18, 2026