CVE-2024-47117

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

IBM Carbon Design System (Carbon Charts 0.4.0 through 1.13.16) is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
IBM	Carbon Charts	>= 0.4.0, <= 1.13.16

References

https://www.ibm.com/support/pages/node/7178269Vendor Advisory

Timeline

Published: Dec 10, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-471187.5IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (inclu CVE-2024-471197.5IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 does not properly validate a certificate which could allow an attacker to spoo CVE-2024-47127.8An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled. This specific fl CVE-2024-471206.8IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7, and 10.0.8 could allow a privileged user to escalate their privileges and atta CVE-2024-471215.3The goTenna Pro App uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is cap CVE-2024-471226.5In the goTenna Pro App, the encryption keys are stored along with a static IV on the End User Device (EUD). This allows for complete decry CVE-2024-471233.1The goTenna Pro App uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. This CVE-2024-471246.5The goTenna Pro App does not encrypt callsigns in messages. It is recommended to not use sensitive information in callsigns when using thi CVE-2024-471255.4The goTenna Pro App does not authenticate public keys which allows an unauthenticated attacker to manipulate messages. It is advised to upd CVE-2024-471268.8The goTenna Pro App does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it CVE-2024-471273.1In the goTenna Pro App there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a softw CVE-2024-471284.3The goTenna Pro App encryption key name is always sent unencrypted when the key is shared over RF through a broadcast message. It is advise