CVE-2024-3800

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Sites managed in S@M CMS (Concept Intermedia) might be vulnerable to Reflected XSS via including scripts in requested file names.  Only a part of observed services is vulnerable, but since vendor has not investigated the root problem, it is hard to determine when the issue appears.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jun 28, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-380028.8The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, CVE-2024-38016.1Sites managed in S@M CMS (Concept Intermedia) might be vulnerable to Reflected XSS via including scripts in one of GET header parameters.  OCVE-2024-380108.0Secure Boot Security Feature Bypass VulnerabilityCVE-2024-380118.0Secure Boot Security Feature Bypass VulnerabilityCVE-2024-380136.7Microsoft Windows Server Backup Elevation of Privilege VulnerabilityCVE-2024-380147.8Windows Installer Elevation of Privilege VulnerabilityCVE-2024-380157.5Windows Remote Desktop Gateway (RD Gateway) Denial of Service VulnerabilityCVE-2024-380167.8Microsoft Office Visio Remote Code Execution VulnerabilityCVE-2024-380175.5Microsoft Message Queuing Information Disclosure VulnerabilityCVE-2024-380188.8Microsoft SharePoint Server Remote Code Execution VulnerabilityCVE-2024-380197.2Microsoft Windows Performance Data Helper Library Remote Code Execution VulnerabilityCVE-2024-380206.5Microsoft Outlook Spoofing Vulnerability
CVE-2024-3800: Medium severity, CVSS 6.1 | Vulnix