CVE-2024-36494

Reflected Cross Site Scripting

State: Published
Severity: 4.7 Medium
Published: Dec 12, 2024
Updated: Nov 3, 2025
Reserved: May 29, 2024

Description

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The login page at /cgi/slogin.cgi suffers from XSS due to improper input filtering of the -tsetup+-uuser parameter, which can only be exploited if the target user is not already logged in. This makes it ideal for login form phishing attempts.

Scores

CVSS	Score	Vector	Source
3.1	4.7 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N	CISA-ADP

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Affected Products

Product	Versions
Scan2NetImage Access GmbH	before 7.42BAffectedfrom 7.42BNot affected

References

https://r.sec-consult.com/imageaccessthird-party-advisory
https://www.imageaccess.de/?page=SupportPortal&lang=enpatch
http://seclists.org/fulldisclosure/2024/Dec/2

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.