by Kastro
Paper/Archive/CVE-2024-12223

CVE-2024-12223

Nutanix Prism Central — Stored Cross-site Scripting (XSS) in Nutanix Prism Central

EPSS 0.3%CVSS 9.3
critical.is priorityof 100
33
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 26.8.268 × 205.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Prism Central versions prior to 2024.3.1 are vulnerable to a stored cross-site scripting attack via the Events component, allowing an attacker to hijack a victim user’s session and perform actions in their security context.

Affected

ProductAffectedFixed inSource
Prism Central< 2024.3.12024.3.1CNA

Scores by source

TML (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refthemissinglink.com.au/security-advisories/cve-2024-12223