CVE-2024-44795: XSS
Published Aug 26, 2024
·Updated
A cross-site scripting (XSS) vulnerability in the component /login/disabled.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter.
Affected Software
1 affected component
Gazelle Project Gazelle<2016-11-08
Event History
Aug 26, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-44795?
CVE-2024-44795 has a high severity rating due to its potential to allow arbitrary script execution.
2
How do I fix CVE-2024-44795?
To fix CVE-2024-44795, ensure proper input validation and sanitization of the username parameter in /login/disabled.php.
3
Who is affected by CVE-2024-44795?
CVE-2024-44795 affects users of Gazelle software versions prior to 2016-11-08.
4
What type of vulnerability is CVE-2024-44795?
CVE-2024-44795 is classified as a cross-site scripting (XSS) vulnerability.
5
Can CVE-2024-44795 be exploited remotely?
Yes, CVE-2024-44795 can be exploited remotely by injecting malicious scripts via the username parameter.