CVE-2024-7709

MEDIUM

OcoMon 4.0RC1/4.0/5.0RC1 - Cross-Site Scripting in URL Handler

Title source: llm
STIX 2.1

Description

A vulnerability, which was classified as problematic, has been found in OcoMon 4.0RC1/4.0/5.0RC1. This issue affects some unknown processing of the file /includes/common/require_access_recovery.php of the component URL Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.0.1 and 5.0 is able to address this issue. It is recommended to upgrade the affected component.

References (5)

Core 5
Core References
Permissions Required, VDB Entry vdb-entry
https://vuldb.com/?id.274205
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.274205
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.388843

Scores

CVSS v3 4.3
EPSS 0.0042
EPSS Percentile 33.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (3)
n/a/OcoMon 4.0
n/a/OcoMon 4.0RC1
n/a/OcoMon 5.0RC1
Published Aug 13, 2024
Tracked Since Feb 18, 2026