Is CVE-2024-24397 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-24397 being exploited in the wild.

How severe is CVE-2024-24397?

Low severity, with a CVSS score of 3.1, published 5 February 2024.

Which products and versions are affected?

stimulsoft-dashboards-js (npm) SEMVER:introduced=0,fixed=2024.1.2; Stimulsoft Dashboard.JS before 2024.1.2.

Is there a fix for CVE-2024-24397?

Yes. stimulsoft-dashboards-js (npm): upgrade to 2024.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-24397 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-24397?

Check whether you run stimulsoft-dashboards-js (npm) or Stimulsoft Dashboard.JS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-24397: Stimulsoft Dashboard.JS cross-site scripting in ReportName field

CVE-2024-24397 · Severity: low · CVSS 3.1 · Published 2024-02-05

Stimulsoft Dashboard.JS is a JavaScript library used to embed interactive dashboards and reports in web applications. A cross-site scripting (XSS) vulnerability allows authenticated users to inject malicious code through the ReportName field, enabling them to execute arbitrary JavaScript in other users' browsers and potentially steal session data or redirect them to malicious sites.

Technologies: stimulsoft-dashboards-js (npm), Stimulsoft Dashboard.JS. Vendors: npm, Stimulsoft.

Quick answers

Is CVE-2024-24397 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-24397 being exploited in the wild.
How severe is CVE-2024-24397?: Low severity, with a CVSS score of 3.1, published 5 February 2024.
Which products and versions are affected?: stimulsoft-dashboards-js (npm) SEMVER:introduced=0,fixed=2024.1.2; Stimulsoft Dashboard.JS before 2024.1.2.
Is there a fix for CVE-2024-24397?: Yes. stimulsoft-dashboards-js (npm): upgrade to 2024.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-24397 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-24397?: Check whether you run stimulsoft-dashboards-js (npm) or Stimulsoft Dashboard.JS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

stimulsoft-dashboards-js (npm): upgrade to 2024.1.2 or later
```
npm install stimulsoft-dashboards-js@2024.1.2
```

Technical details

This is a stored or reflected cross-site scripting (CWE-79) vulnerability in the ReportName field of Stimulsoft Dashboard.JS versions before 2024.1.2. The vulnerability allows an authenticated attacker to craft a payload containing JavaScript code that is not properly sanitized before being rendered in the application. The attack requires login credentials and user interaction (a victim must view the crafted report), but when successful allows execution of arbitrary JavaScript in the victim's browser with the ability to steal credentials, modify page content, or perform actions on behalf of the victim. The vulnerability is fixed in version 2024.1.2 and later.

Affected products

Stimulsoft Dashboard.JS before 2024.1.2

Identifiers

CVE-2024-24397
GHSA-9cgf-pxwq-2cpw

Timeline

2024-02-05: disclosed
2024-01-01: patched: Fixed in version 2024.1.2

References

https://cloud-trustit.spp.at/s/Pi78FFazHamJQ5R

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.