CVE-2024-31159 - Vulnerability Details - OpenCVE

The parameter used in the certain page of ASUS Download Master is not properly filtered for user input. A remote attacker with administrative privilege can insert JavaScript code to the parameter for Reflected Cross-site scripting attacks.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Asus	Download Master

Configuration 1 [-]

cpe:2.3:a:asus:download_master:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.twcert.org.tw/en/cp-139-7862-e43e4-2.html
https://www.twcert.org.tw/tw/cp-132-7861-1a06f-1.html

History

Fri, 16 Aug 2024 20:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Asus Asus download Master
CPEs		cpe:2.3:a:asus:download_master::::::::
Vendors & Products		Asus Asus download Master

MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2024-06-14T03:25:03.735Z

Updated: 2024-08-02T01:46:04.534Z

Reserved: 2024-03-29T07:18:19.359Z

Link: CVE-2024-31159

Vulnrichment

Updated: 2024-06-14T18:14:43.414Z

NVD

Status : Modified

Published: 2024-06-14T04:15:41.790

Modified: 2024-11-21T09:12:56.343

Link: CVE-2024-31159

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-31159", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2024-03-29T07:18:19.359Z", "datePublished": "2024-06-14T03:25:03.735Z", "dateUpdated": "2024-08-02T01:46:04.534Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Download Master", "vendor": "ASUS", "versions": [{"lessThanOrEqual": "3.1.0.113", "status": "affected", "version": "earlier", "versionType": "custom"}]}], "datePublic": "2024-06-14T03:21:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The parameter used in the certain page of ASUS Download Master is not properly filtered for user input. A remote attacker with administrative privilege can insert JavaScript code to the parameter for Reflected Cross-site scripting attacks."}], "value": "The parameter used in the certain page of ASUS Download Master is not properly filtered for user input. A remote attacker with administrative privilege can insert JavaScript code to the parameter for Reflected Cross-site scripting attacks."}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591 Reflected XSS"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-06-14T03:25:03.735Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-7861-1a06f-1.html"}, {"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/en/cp-139-7862-e43e4-2.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Upate to version 3.1.0.114 or later."}], "value": "Upate to version 3.1.0.114 or later."}], "source": {"advisory": "TVN-202406004", "discovery": "EXTERNAL"}, "title": "ASUS Download Master - Reflected XSS", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-14T18:14:39.230042Z", "id": "CVE-2024-31159", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-14T18:14:45.924Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:46:04.534Z"}, "title": "CVE Program Container", "references": [{"tags": ["third-party-advisory", "x_transferred"], "url": "https://www.twcert.org.tw/tw/cp-132-7861-1a06f-1.html"}, {"tags": ["third-party-advisory", "x_transferred"], "url": "https://www.twcert.org.tw/en/cp-139-7862-e43e4-2.html"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-31159", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-14T18:14:39.230042Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-14T18:14:43.414Z"}}], "cna": {"title": "ASUS Download Master - Reflected XSS", "source": {"advisory": "TVN-202406004", "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591 Reflected XSS"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ASUS", "product": "Download Master", "versions": [{"status": "affected", "version": "earlier", "versionType": "custom", "lessThanOrEqual": "3.1.0.113"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upate to version 3.1.0.114 or later.", "supportingMedia": [{"type": "text/html", "value": "Upate to version 3.1.0.114 or later.", "base64": false}]}], "datePublic": "2024-06-14T03:21:00.000Z", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7861-1a06f-1.html", "tags": ["third-party-advisory"]}, {"url": "https://www.twcert.org.tw/en/cp-139-7862-e43e4-2.html", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The parameter used in the certain page of ASUS Download Master is not properly filtered for user input. A remote attacker with administrative privilege can insert JavaScript code to the parameter for Reflected Cross-site scripting attacks.", "supportingMedia": [{"type": "text/html", "value": "The parameter used in the certain page of ASUS Download Master is not properly filtered for user input. A remote attacker with administrative privilege can insert JavaScript code to the parameter for Reflected Cross-site scripting attacks.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-06-14T03:25:03.735Z"}}}, "cveMetadata": {"cveId": "CVE-2024-31159", "state": "PUBLISHED", "dateUpdated": "2024-06-14T18:14:45.924Z", "dateReserved": "2024-03-29T07:18:19.359Z", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "datePublished": "2024-06-14T03:25:03.735Z", "assignerShortName": "twcert"}, "dataVersion": "5.1"}