PT-2024-28037 · Uniview · Uniview Nvr301-04S2-P4

Bleron Rrustemi + 1 · Published 2024-06-10 · Updated 2024-06-12 · CVE-2024-3850

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Uniview NVR301-04S2-P4

Description The issue is related to a reflected cross-site scripting attack (XSS), where an attacker could send a user a URL that, if clicked, could execute malicious JavaScript in their browser. This issue requires authentication before it can be exploited, limiting its scope and severity. Even if JavaScript is executed, no additional benefits are obtained for the attacker.

Recommendations For Uniview NVR301-04S2-P4, consider disabling access to potentially vulnerable API endpoints until a patch is available. Restrict access to sensitive areas of the application that may be susceptible to XSS attacks. Avoid using links from untrusted sources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-3850

Affected Products

Uniview Nvr301-04S2-P4

References · 5

• 🔥 https://github.com/r3naissance/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3850.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-3850 · Security Note
• https://osv.dev/vulnerability/CVE-2024-3850 · Vendor Advisory
• https://cisa.gov/news-events/ics-advisories/icsa-24-156-01 · Note
• https://twitter.com/CVEnew/status/1800214523674054657 · Twitter Post