What’s Vulnerable › Vulnerabilities

CVE-2024-36494: Reflected Cross Site Scripting

• Severity: medium (CVSS 4.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-12-12 · updated 2026-06-17
• Weakness: CWE-79

Description

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The login page at /cgi/slogin.cgi suffers from XSS due to improper input filtering of the -tsetup+-uuser parameter, which can only be exploited if the target user is not already logged in. This makes it ideal for login form phishing attempts.

Affected products

• Image Access GmbH Scan2Net: before 7.42B — fixed in 7.42B

How to fix

Upgrade to a fixed version: Image Access GmbH Scan2Net 7.42B. Check the vendor advisory for mitigations.

References

• https://r.sec-consult.com/imageaccess
• https://www.imageaccess.de/?page=SupportPortal&lang=en
• http://seclists.org/fulldisclosure/2024/Dec/2

Get alerted when CVE-2024-36494 or the next vulnerability affects your stack