CVE-2024-3850
Medium
Description
Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack (XSS). An attacker could send a user a URL that if clicked on could execute malicious JavaScript in their browser. This vulnerability also requires authentication before it can be exploited, so the scope and severity is limited. Also, even if JavaScript is executed, no additional benefits are obtained.
SeverityMedium
CVSS5.4
Exploit probability—
ProductUniview Nvr301-04s2-p4 Firmware
PublishedJun 10, 2024
First seenJun 10, 2024
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- uniview nvr301-04s2-p4_firmwarenvr-b3801.20.17.240507 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| uniview nvr301-04s2-p4_firmware | v < nvr-b3801.20.17.240507 | nvr-b3801.20.17.240507 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.