CVE-2024-3801

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Sites managed in S@M CMS (Concept Intermedia) might be vulnerable to Reflected XSS via including scripts in one of GET header parameters.  Only a part of observed services is vulnerable, but since vendor has not investigated the root problem, it is hard to determine when the issue appears.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
Concept IntermediaS@M CMS<= 3.3

References

Timeline

Published
Jun 28, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-380108.0Secure Boot Security Feature Bypass VulnerabilityCVE-2024-380118.0Secure Boot Security Feature Bypass VulnerabilityCVE-2024-380136.7Microsoft Windows Server Backup Elevation of Privilege VulnerabilityCVE-2024-380147.8Windows Installer Elevation of Privilege VulnerabilityCVE-2024-380157.5Windows Remote Desktop Gateway (RD Gateway) Denial of Service VulnerabilityCVE-2024-380167.8Microsoft Office Visio Remote Code Execution VulnerabilityCVE-2024-380175.5Microsoft Message Queuing Information Disclosure VulnerabilityCVE-2024-380188.8Microsoft SharePoint Server Remote Code Execution VulnerabilityCVE-2024-380197.2Microsoft Windows Performance Data Helper Library Remote Code Execution VulnerabilityCVE-2024-380206.5Microsoft Outlook Spoofing VulnerabilityCVE-2024-380218.8Microsoft Outlook Remote Code Execution VulnerabilityCVE-2024-380227.0Windows Image Acquisition Elevation of Privilege Vulnerability
CVE-2024-3801: Medium severity, CVSS 6.1 | Vulnix