CVE-2024-26135

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

MeshCentral is a full computer management web site. Versions prior to 1.1.21 a cross-site websocket hijacking (CSWSH) vulnerability within the control.ashx endpoint. This component is the primary mechanism used within MeshCentral to perform administrative actions on the server. The vulnerability is exploitable when an attacker is able to convince a victim end-user to click on a malicious link to a page hosting an attacker-controlled site. The attacker can then originate a cross-site websocket connection using client-side JavaScript code to connect to `control.ashx` as the victim user within MeshCentral. Version 1.1.21 contains a patch for this issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-346

Affected software

No affected versions have been published.

Timeline

Published
Feb 20, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-261367.5kedi ElectronCord is a bot management tool for Discord. Commit aaaeaf4e6c99893827b2eea4dd02f755e1e24041 exposes an account access token in tCVE-2024-261385.3The XWiki licensor application, which manages and enforce application licenses for paid extensions, includes the document `Licenses.Code.LicCVE-2024-261398.1OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Due to lack oCVE-2024-26148.8Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these bugs showed evidence of memory corruptionCVE-2024-261406.1com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a malicCVE-2024-261417.5Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large responCVE-2024-261427.5Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routinCVE-2024-261436.1Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. ApplicaCVE-2024-261445.3Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage.CVE-2024-261454.3Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on Discourse. Uninvited users are able to gainCVE-2024-261467.5Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resultiCVE-2024-261477.5Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm pars