CVE-2024-28141: Cross-Site Request-Forgery

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-11 · updated 2026-06-17
Weakness: CWE-352

Description

The web application is not protected against cross-site request forgery attacks. Therefore, an attacker can trick users into performing actions on the application when they visit an attacker-controlled website or click on a malicious link. E.g. an attacker can forge malicious links to reset the admin password or create new users.

Affected products

Image Access GmbH Scan2Net: before 7.40 — fixed in 7.40

How to fix

Upgrade to a fixed version: Image Access GmbH Scan2Net 7.40. Check the vendor advisory for mitigations.

References

https://r.sec-consult.com/imageaccess
https://www.imageaccess.de/?page=SupportPortal&lang=en
http://seclists.org/fulldisclosure/2024/Dec/2

Get alerted when CVE-2024-28141 or the next vulnerability affects your stack