PT-2024-27518 · Smseagle · Smseagle

Vincent Salvadori · Published 2024-08-23 · Updated 2025-01-09 · CVE-2024-37392

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SMSEagle versions prior to 6.0

Description A stored Cross-Site Scripting (XSS) issue has been identified. The application did not properly sanitize user input in SMS messages in the inbox, allowing an attacker to inject malicious JavaScript code into an SMS message. This code gets executed when the SMS is viewed and specially interacted with in the web-GUI.

Recommendations For versions prior to 6.0, update to version 6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the inbox feature in the web-GUI to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-37392

Affected Products

Smseagle

References · 7

• https://osv.dev/vulnerability/CVE-2024-37392 · Vendor Advisory
• https://smseagle.eu/2024/08/21/resolved-xss-in-smseagle-software-cve-2024-37392 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37392 · Security Note
• https://smseagle.eu/security-advisory/resolved-xss-in-smseagle-software-cve-2024-37392 · Note
• https://twitter.com/VulmonFeeds/status/1827110540059066528 · Twitter Post
• https://twitter.com/CVEnew/status/1827091972420415789 · Twitter Post
• https://t.me/cvedetector/4044 · Telegram Post