What is CVE-2024-6449?

CVE-2024-6449 is a medium-severity vulnerability in Hyperview Geoportal Toolkit, classified under Permissive Cross-domain Policy with Untrusted Domains. CVSS score: 6.5/10. Published 2024-08-28.

How severe is CVE-2024-6449?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Hyperview Geoportal Toolkit

CVE-2024-6449

HyperView Geoportal Toolkit in versions lower than 8.5.0 does not restrict cross-domain requests when fetching remote content pointed by one of GET request parameters. An unauthenticated remote attacker can prepare links, which upon opening will load scripts from a remote location controlled by the attacker and execute them in the user space. By manipulating this parameter it is also possible to enumerate some of the devices in Local Area Network in which the server resides.

EPSS: 0.004 (27.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.

Affected products

Hyperview Geoportal Toolkit — versions 0
Hyperview Geoportal_toolkit

Weakness classification (CWE)

CWE-942 — Permissive Cross-domain Policy with Untrusted Domains

References

cvd@cert.pl (Third Party Advisory)
cvd@cert.pl (Third Party Advisory)

Frequently asked questions

What is CVE-2024-6449?: CVE-2024-6449 is a medium-severity vulnerability in Hyperview Geoportal Toolkit, classified under Permissive Cross-domain Policy with Untrusted Domains. CVSS score: 6.5/10. Published 2024-08-28.
How severe is CVE-2024-6449?: Medium severity. CVSS v3 base score is 6.5 out of 10.