« Volver al listado

CVE-2024-11021

Estado: AnalizadaMedia (5.4)—

Webopac from Grand Vice info has Stored Cross-site Scripting vulnerability. Remote attackers with regular privileges can inject arbitrary JavaScript code into the server. When users visit the compromised page, the code is automatically executed in their browser.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Vice — Webopac

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-11021",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-11021",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-11T11:54:02.775307Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "twcert@cert.org.tw",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "twcert@cert.org.tw",
      "affectedData": [
        {
          "vendor": "Grand Vice info",
          "product": "Webopac",
          "versions": [
            {
              "status": "affected",
              "version": "6",
              "lessThan": "6.5.3",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "7",
              "lessThan": "7.2.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-11-11T08:15:04.987",
  "references": [
    {
      "url": "https://www.twcert.org.tw/en/cp-139-8220-e75c2-2.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "twcert@cert.org.tw"
    },
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-8219-f12d0-1.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "twcert@cert.org.tw"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "twcert@cert.org.tw",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Webopac from Grand Vice info has Stored Cross-site Scripting vulnerability. Remote attackers with regular privileges can inject arbitrary JavaScript code into the server. When users visit the compromised page, the code is automatically executed in their browser."
    },
    {
      "lang": "es",
      "value": "Webopac de Grand Vice Info presenta una vulnerabilidad de Cross-site Scripting almacenado. Los atacantes remotos con privilegios normales pueden inyectar código JavaScript arbitrario en el servidor. Cuando los usuarios visitan la página comprometida, el código se ejecuta automáticamente en su navegador."
    }
  ],
  "lastModified": "2026-06-17T06:56:54.013",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vice:webopac:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "05F9B655-8FA4-48EC-A45C-2023F4C74AF9",
              "versionEndExcluding": "6.5.1",
              "versionStartIncluding": "6"
            },
            {
              "criteria": "cpe:2.3:a:vice:webopac:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A2179D8C-B827-4464-918B-5C74013AC527",
              "versionEndExcluding": "7.2.3",
              "versionStartIncluding": "7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "twcert@cert.org.tw"
}