CVE-2024-4424
Assigner: CERT-PL
Published: 2024-05-09T09:36:58.788Z
State: PUBLISHED
affected: defaultStatus: unknown
product: CemiPark
vendor: CEMI Tomasz Pawełek
versions: status: affected
version: 4.5
status: affected
version: 4.7
status: affected
version: 5.03
credits: type: finder
value: Dariusz Gońda
descriptions: supportingMedia: base64: no
type: text/html
value: The access control in&nbsp;<span style="background-color: rgb(255, 255, 255);">CemiPark software</span> does not properly validate user-entered data, which allows the stored cross-site scripting (XSS) attack. The parameters used to enter data into the system do not have appropriate validation, which makes possible to smuggle in HTML/JavaScript code. This code will be executed in the user's browser space.<p>This issue affects CemiPark software: 4.5, 4.7, 5.03 and potentially others. The vendor refused to provide the specific range of affected products.</p>
value: The access control in CemiPark software does not properly validate user-entered data, which allows the stored cross-site scripting (XSS) attack. The parameters used to enter data into the system do not have appropriate validation, which makes possible to smuggle in HTML/JavaScript code. This code will be executed in the user's browser space.This issue affects CemiPark software: 4.5, 4.7, 5.03 and potentially others. The vendor refused to provide the specific range of affected products.


impacts: capecId: CAPEC-592
descriptions: value: CAPEC-592 Stored XSS
problemTypes: descriptions: cweId: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
type: CWE
source: discovery: UNKNOWN
title: Stored XSS in CemiPark
x_generator: engine: Vulnogram 0.1.0-dev