« Volver al listado

CVE-2024-46081

Estado: AnalizadaMedia (5.4)—

Scriptcase v9.10.023 y versiones anteriores son vulnerables a ataques de Cross-Site Scripting (XSS). Un usuario autenticado puede manipular payloads maliciosos en la lista de tareas pendientes. El usuario asignado activará un XSS almacenado, lo que es particularmente peligroso porque las tareas se asignan a varios usuarios en la plataforma.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Scriptcase — Scriptcase

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-46081",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-46081",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-01T19:31:45.733971Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:scriptcase:scriptcase:*:*:*:*:*:*:*:*"
          ],
          "vendor": "scriptcase",
          "product": "scriptcase",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "9.10.023"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-10-01T19:15:08.763",
  "references": [
    {
      "url": "https://blog.hawktesters.com/zero-day-alert-scriptcase-vulnerabilities-xss/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS). An authenticated user can craft malicious payloads in the To-Do List. The assigned user will trigger a stored XSS, which is particularly dangerous because tasks are assigned to various users on the platform."
    },
    {
      "lang": "es",
      "value": "Scriptcase v9.10.023 y versiones anteriores son vulnerables a ataques de Cross-Site Scripting (XSS). Un usuario autenticado puede manipular payloads maliciosos en la lista de tareas pendientes. El usuario asignado activará un XSS almacenado, lo que es particularmente peligroso porque las tareas se asignan a varios usuarios en la plataforma."
    }
  ],
  "lastModified": "2026-06-17T07:55:09.953",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:scriptcase:scriptcase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C8CDCB25-A6AA-46ED-B8EC-64356BE7E190",
              "versionEndIncluding": "9.10.023"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}