CVE-2024-52882

An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to improper neutralization of input via the devices API, an attacker can inject malicious JavaScript code (XSS) to attack logged-in administrator sessions.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
mitreCNA
---
---
CISA-ADPADP
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 12%
VendorProductVersion
audiocodesone_voice_operations_center
𝑥
< 8.4.582
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.audiocodes.com/solutions-products/products/management-products-solutions/one-voice-operations-center
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-076.txt