CVE-2024-37741

EUVD-2024-36814
OpenPLC 3 through 9cd8f1b allows XSS via an SVG document as a profile picture.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CISA-ADPADP
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 57%
Affected Products (NVD)
VendorProductVersion
openplcprojectopenplc_v3_firmware
-
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://1d8.github.io/cves/cve_2024_37741/
https://github.com/thiagoralves/OpenPLC_v3/blob/9cd8f1b53a50f9d38708096bfc72bcbb1ef47343/webserver/pages.py#L992
https://github.com/thiagoralves/OpenPLC_v3/issues/242
https://1d8.github.io/cves/cve_2024_37741/
https://github.com/thiagoralves/OpenPLC_v3/blob/9cd8f1b53a50f9d38708096bfc72bcbb1ef47343/webserver/pages.py#L992
https://github.com/thiagoralves/OpenPLC_v3/issues/242