CVE-2024-22397

HighCVSS 8.3/10Last modified Jun 17, 2026

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the SonicOS SSLVPN portal allows a remote authenticated attacker as a firewall 'admin' user to store and execute arbitrary JavaScript code.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 14, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-223984.9An improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in SonicWall Email Security Appliance could al CVE-2024-223999.8Deserialization of Untrusted Data vulnerability in Apache Seata. When developers disable authentication on the Seata-Server and do not use CVE-2024-22407.2Docker daemon in Brocade SANnav before SANnav 2.3.1b runs without auditing. The vulnerability could allow a remote authenticated attacker to CVE-2024-224006.1Nextcloud User Saml is an app for authenticating Nextcloud users using SAML. In affected versions users can be given a link to the Nextcloud CVE-2024-224014.3Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users could change t CVE-2024-224025.4Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to l CVE-2024-224033.7Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access CVE-2024-224044.3Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can do CVE-2024-224055.5XADMaster is an objective-C library for archive and file unarchiving and extraction. When extracting a specially crafted zip archive XADMast CVE-2024-224069.8Shopware is an open headless commerce platform. The Shopware application API contains a search functionality which enables users to search t CVE-2024-224076.5Shopware is an open headless commerce platform. In the Shopware CMS, the state handler for orders fails to sufficiently verify user authoriz CVE-2024-224088.1Shopware is an open headless commerce platform. The implemented Flow Builder functionality in the Shopware application does not adequately v