CVE-2024-45714 - Vulnerability Details - OpenCVE

Application is vulnerable to Cross Site Scripting (XSS) an authenticated attacker with users’ permissions can modify a variable with a payload.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Solarwinds	Serv-u

Configuration 1 [-]

cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45714

History

Wed, 30 Oct 2024 21:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Solarwinds Solarwinds serv-u
CPEs		cpe:2.3:a:solarwinds:serv-u::::::::
Vendors & Products		Solarwinds Solarwinds serv-u

Wed, 16 Oct 2024 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 16 Oct 2024 07:45:00 +0000

Type	Values Removed	Values Added
Description		Application is vulnerable to Cross Site Scripting (XSS) an authenticated attacker with users’ permissions can modify a variable with a payload.
Title		SolarWinds Serv-U Stored XSS Vulnerability
Weaknesses		CWE-79
References		https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45714
Metrics		cvssV3_1 `{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: SolarWinds

Published: 2024-10-16T07:26:04.406Z

Updated: 2024-10-16T13:23:27.763Z

Reserved: 2024-09-05T08:28:03.888Z

Link: CVE-2024-45714

Vulnrichment

Updated: 2024-10-16T13:23:23.746Z

NVD

Status : Analyzed

Published: 2024-10-16T08:15:06.897

Modified: 2024-10-30T20:33:59.393

Link: CVE-2024-45714

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-45714", "assignerOrgId": "49f11609-934d-4621-84e6-e02e032104d6", "state": "PUBLISHED", "assignerShortName": "SolarWinds", "dateReserved": "2024-09-05T08:28:03.888Z", "datePublished": "2024-10-16T07:26:04.406Z", "dateUpdated": "2024-10-16T13:23:27.763Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Serv-U", "vendor": "SolarWinds", "versions": [{"status": "affected", "version": "Serv-U 15.4.2 HF2 and previous versions"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Simon Wattier"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Application is vulnerable to Cross Site Scripting (XSS) an authenticated attacker with users\u2019 permissions can modify a variable with a payload."}], "value": "Application is vulnerable to Cross Site Scripting (XSS) an authenticated attacker with users\u2019 permissions can modify a variable with a payload."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "49f11609-934d-4621-84e6-e02e032104d6", "shortName": "SolarWinds", "dateUpdated": "2024-10-16T07:26:04.406Z"}, "references": [{"url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45714"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "SolarWinds recommends that customers upgrade to Serv-U 15.5 as soon as it becomes available.\n\n<br>"}], "value": "SolarWinds recommends that customers upgrade to Serv-U 15.5\u00a0as soon as it becomes available."}], "source": {"discovery": "EXTERNAL"}, "title": "SolarWinds Serv-U Stored XSS Vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-16T13:23:18.677097Z", "id": "CVE-2024-45714", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-16T13:23:27.763Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-45714", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-16T13:23:18.677097Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-16T13:23:23.746Z"}}], "cna": {"title": "SolarWinds Serv-U Stored XSS Vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Simon Wattier"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SolarWinds", "product": "Serv-U", "versions": [{"status": "affected", "version": "Serv-U 15.4.2 HF2 and previous versions"}], "defaultStatus": "affected"}], "solutions": [{"lang": "en", "value": "SolarWinds recommends that customers upgrade to Serv-U 15.5\u00a0as soon as it becomes available.", "supportingMedia": [{"type": "text/html", "value": "SolarWinds recommends that customers upgrade to Serv-U 15.5 as soon as it becomes available.\n\n<br>", "base64": false}]}], "references": [{"url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45714"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Application is vulnerable to Cross Site Scripting (XSS) an authenticated attacker with users\u2019 permissions can modify a variable with a payload.", "supportingMedia": [{"type": "text/html", "value": "Application is vulnerable to Cross Site Scripting (XSS) an authenticated attacker with users\u2019 permissions can modify a variable with a payload.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "49f11609-934d-4621-84e6-e02e032104d6", "shortName": "SolarWinds", "dateUpdated": "2024-10-16T07:26:04.406Z"}}}, "cveMetadata": {"cveId": "CVE-2024-45714", "state": "PUBLISHED", "dateUpdated": "2024-10-16T13:23:27.763Z", "dateReserved": "2024-09-05T08:28:03.888Z", "assignerOrgId": "49f11609-934d-4621-84e6-e02e032104d6", "datePublished": "2024-10-16T07:26:04.406Z", "assignerShortName": "SolarWinds"}, "dataVersion": "5.1"}