PT-2025-10604 · E Vision · Evisions Maps

Muhammad Zeeshan + 1 · Published 2025-03-10 · Updated 2025-03-10 · CVE-2024-53307

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Evisions MAPS version 6.10.2.267

Description A reflected cross-site scripting issue allows attackers to execute arbitrary code in the context of a user's browser by injecting a crafted payload into the "mw/" endpoint.

Recommendations For Evisions MAPS version 6.10.2.267, consider restricting access to the /mw/ endpoint until a fix is available. As a temporary workaround, avoid using the vulnerable endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-53307

Affected Products

Evisions Maps

References · 6

• 🔥 https://gist.github.com/Xib3rR4dAr/bf754848f1cd77162f79226144b04648 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-53307 · Security Note
• https://osv.dev/vulnerability/CVE-2024-53307 · Vendor Advisory
• https://webhelp.evisions.com/releaseguides/maps/default.htm#6.11/6.11%20Release%20Notes.htm?TocPath=MAPS%25206.11%2520Release%2520Guide%257C_____3 · Note
• https://twitter.com/CVEnew/status/1899151386887192984 · Twitter Post
• https://t.me/cvedetector/19978 · Telegram Post