Stored cross site scripting

Published 22 mo ago 2024-12-12 · modified 4 mo ago 2026-06-17 · JSON

CVSS

4.7

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.6%

percentile 46%

Public exploits

none known

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit Disclaimer Text" function of the configuration menu is vulnerable to stored XSS. Only the users Poweruser and Admin can use this function which is available at the URL

https://$SCANNER/cgi/admin.cgi?-rdisclaimer+-apre

The stored Javascript payload will be executed every time the ScanWizard is loaded, even in the Kiosk-mode browser. Version 7.40 implemented a fix, but it could be bypassed via URL-encoding the Javascript payload again.

CISA SSVC assessment

Exploitation: Proof of concept public
Automatable: no
Technical impact: partial
Assessed: 22 mo ago 2024-12-12

Exploit prediction (EPSS)

0.55% probability of exploitation in the next 30 days, higher than 46% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	4.7	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N`
CNA	3.1	4.7	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N`

Affected products

Image Access GmbH Scan2Net

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

r.sec-consult.com /imageaccess · third-party-advisory
imageaccess.de /?page=SupportPortal&lang=en · patch
seclists.org /fulldisclosure/2024/Dec/2

Sources

CVE List: CVE-2024-36498
NVD: CVE-2024-36498

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary