« Volver al listado

CVE-2024-8413

Estado: AnalizadaMedia (6.1)—

Vulnerabilidad de cross site scripting (XSS) a través del parámetro action en index.php. Código base del producto afectado https://github.com/Bioshox/Raspcontrol y bifurcaciones como https://github.com/harmon25/raspcontrol. Un atacante podría aprovechar esta vulnerabilidad enviando un payload de JavaScript especialmente manipulado a un usuario autenticado y secuestrando parcialmente los detalles de su sesión. Lista de referencias

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Raspcontrol Project — Raspcontrol

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-8413",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-8413",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-04T13:07:47.035504Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve-coordination@incibe.es",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve-coordination@incibe.es",
      "affectedData": [
        {
          "vendor": "RaspControl",
          "product": "RaspControl",
          "versions": [
            {
              "status": "affected",
              "version": "1.0"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-09-04T11:15:12.780",
  "references": [
    {
      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-raspcontrol",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve-coordination@incibe.es"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve-coordination@incibe.es",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross Site Scripting (XSS) vulnerability through the action parameter in index.php. Affected product codebase  https://github.com/Bioshox/Raspcontrol  and forks such as  https://github.com/harmon25/raspcontrol . An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload to an authenticated user and partially hijacking their session details.\n\nReferences list"
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de cross site scripting (XSS) a través del parámetro action en index.php. Código base del producto afectado https://github.com/Bioshox/Raspcontrol y bifurcaciones como https://github.com/harmon25/raspcontrol. Un atacante podría aprovechar esta vulnerabilidad enviando un payload de JavaScript especialmente manipulado a un usuario autenticado y secuestrando parcialmente los detalles de su sesión. Lista de referencias"
    }
  ],
  "lastModified": "2026-06-17T08:22:32.143",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:raspcontrol_project:raspcontrol:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3292D8A2-245A-46AB-8E3F-687C66498853"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve-coordination@incibe.es"
}