CVE-2024-22397
High
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the SonicOS SSLVPN portal allows a remote authenticated attacker as a firewall 'admin' user to store and execute arbitrary JavaScript code.
SeverityHigh
CVSS8.3
Exploit probability—
Product
SonicOS
PublishedMar 14, 2024
First seenMar 14, 2024
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| SonicWall SonicOS | 7.0.1-5145 and earlier versions, 7.1.1-7047 and earlier versions | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.