Description

Certain switch models from PLANET Technology have a web application that does not properly validate specific parameters, allowing remote authenticated users with administrator privileges to inject arbitrary JavaScript, leading to Stored XSS attack.

Related CPE's

o

planet

gs-4210-24p2s_firmware

Vulnerable

h

planet

gs-4210-24p2s

3.0

o

planet

gs-4210-24pl4c_firmware

Vulnerable

h

planet

gs-4210-24pl4c

2.0

References

https://www.twcert.org.tw/en/cp-139-8064-70255-2.html

Third Party Advisory

https://www.twcert.org.tw/tw/cp-132-8063-01634-1.html

Third Party Advisory

Weaknesses

[email protected]

Primary
CWE-79

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.8 · Medium

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2024-09-30T08:15:05.020

1 week ago

Last modified

2024-10-04T14:45:41.310

4 days ago