PT-2025-9568 · Unknown · Easyvirt Dc Netscope

Aurélien Bourdois · Publicado 2025-03-03 · Atualizado 2025-03-07 · CVE-2024-55064

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions EasyVirt DC NetScope versions 8.6.4 and earlier

Description Multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary JavaScript or HTML code via vulnerable parameters. The affected parameters include smtp server, smtp account, smtp password, and email recipients in the /smtp/update endpoint, ntp or dns in the /proxy/ntp/change endpoint, and newVcenterAddress in the /process new vcenter endpoint.

Recommendations For EasyVirt DC NetScope versions 8.6.4 and earlier, update to a version later than 8.6.4 to resolve the issue. As a temporary workaround, consider restricting access to the /smtp/update, /proxy/ntp/change, and /process new vcenter endpoints until a patch is available. Avoid using the vulnerable parameters smtp server, smtp account, smtp password, email recipients, ntp, dns, and newVcenterAddress in the affected endpoints until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2024-55064

Produtos afetados

Easyvirt Dc Netscope

Referências · 6

• 🔥 https://github.com/Elymaro/CVE/blob/main/EasyVirt/CVE-2024-55064.md · Exploit
• https://t.me/cvedetector/19435 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2024-55064 · Nota de Segurança
• https://twitter.com/CVEnew/status/1897912349308399868 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1896704357480993093 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2024-55064 · Aviso do Fabricante