Live › vulnerability › CVE-2024-7075
The user search feature in a management console does not encode input before showing it, so an attacker can inject a script that runs in the browser of whoever views the page. The script can redirect users, alter the page, or read information from the browser, but httpOnly session cookies block direct session hijacking.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 10:22 UTC. All times on this page are UTC.
The sources do not name the product or versions. Teams running the affected management console should look for it in their own inventory. Exposure requires a user to be able to reach the console's search function with attacker-supplied input.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The user search function within the management console fails to properly encode user-supplied input before rendering it in the browser. This allows an attacker to inject malicious scripts that are then executed by the user's browser in the context of the management console.
Successful exploitation enables an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract information from the browser. However, due to the use of the httpOnly flag on sensitive session cookies, session hijacking or similar attacks are prevented.
This page as .md · .json · in your agent: get_signal("CVE-2024-7075")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.