CVE-2024-31946: XSS
First published: Mon Jul 15 2024(Updated: )
An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.41, 3.10.0 through 3.11.29, 4.0 through 4.3.24, and 4.4.0 through 4.7.4. A user who has access to the SNS with write access on the email alerts page has the ability to create alert email containing malicious JavaScript, executed by the template preview. The following versions fix this: 3.7.42, 3.11.30, 4.3.25, and 4.7.5.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Stormshield Network Security | >=3.7.0<=3.7.41>=3.10.0<3.11.29>=4.0<=4.3.24>=4.4.0<=4.7.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-31946?
CVE-2024-31946 has a high severity rating due to its potential for Cross-Site Scripting (XSS) attacks through malicious JavaScript in email alerts.
How do I fix CVE-2024-31946?
To fix CVE-2024-31946, update your Stormshield Network Security software to a version beyond 4.7.4 or apply any available security patches.
What versions are affected by CVE-2024-31946?
CVE-2024-31946 affects Stormshield Network Security versions 3.7.0 to 3.7.41, 3.10.0 to 3.11.29, and 4.0 to 4.7.4.
Who is vulnerable to CVE-2024-31946?
Users with write access on the email alerts page within the affected versions of Stormshield Network Security are vulnerable to CVE-2024-31946.
What types of attacks can exploit CVE-2024-31946?
CVE-2024-31946 can be exploited for Cross-Site Scripting (XSS) attacks, allowing an attacker to execute malicious scripts in the user's browser.
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- agent/author
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/stormshield
- canonical/stormshield network security