Critical – 9.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

PT-2024-87: Reflected Cross-Site Scripting (XSS) in Netcat CMS (stats module)

Error type:

  • CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Vulnerability vector:

  • Base vulnerability score (CVSSv3.1): CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
  • Severity (CVSSv3.1): 8.4 (high)
  • Base vulnerability score (CVSSv4.0): CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
  • Severity (CVSSv4.0): 9.3 (critical)

Description:

The vulnerability was identified in Netcat (stats module), version 6.4 Extra.

The discovered vulnerability allows an authorized attacker with the administrator role to execute arbitrary JavaScript code in the browser of the attacked user.

Vulnerability status: Confirmed by vendor

Date of vulnerability remediation: 20.08.2024

Recommendations:

  • Update to version or higher

Additional information:

Researcher: Aleksey Solovev (Positive Technologies)

Identifiers:

BDU:2024-06392

Vendor:

Netcat

Vulnerable product:

Netcat CMS

Vulnerable versions:

6.4 Extra