PT-2025-9568 · Unknown · Easyvirt Dc Netscope

Aurélien Bourdois · Published 2025-03-03 · Updated 2025-03-07 · CVE-2024-55064

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions EasyVirt DC NetScope versions 8.6.4 and earlier

Description Multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary JavaScript or HTML code via vulnerable parameters. The affected parameters include smtp server, smtp account, smtp password, and email recipients in the /smtp/update endpoint, ntp or dns in the /proxy/ntp/change endpoint, and newVcenterAddress in the /process new vcenter endpoint.

Recommendations For EasyVirt DC NetScope versions 8.6.4 and earlier, update to a version later than 8.6.4 to resolve the issue. As a temporary workaround, consider restricting access to the /smtp/update, /proxy/ntp/change, and /process new vcenter endpoints until a patch is available. Avoid using the vulnerable parameters smtp server, smtp account, smtp password, email recipients, ntp, dns, and newVcenterAddress in the affected endpoints until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-55064

Affected Products

Easyvirt Dc Netscope

References · 6

• 🔥 https://github.com/Elymaro/CVE/blob/main/EasyVirt/CVE-2024-55064.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-55064 · Security Note
• https://osv.dev/vulnerability/CVE-2024-55064 · Vendor Advisory
• https://t.me/cvedetector/19435 · Telegram Post
• https://twitter.com/CVEnew/status/1897912349308399868 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1896704357480993093 · Twitter Post