CVE-2024-34061
Published: 02 May 2024
Summary
CVE-2024-34061 is a medium-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 4.3 (Medium).
Operationally, ranked in the top 3.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
changedetection.io is an open source web page change detection and notification service that is affected by a reflected cross-site scripting vulnerability tracked as CVE-2024-34061. The flaw stems from insufficient processing of user-supplied input in the notification_urls parameter, allowing injected JavaScript to execute in the context of the application when the input is reflected back in responses without sanitization. The issue is classified under CWE-79 with a CVSS 3.1 score of 4.3.
An unauthenticated remote attacker can exploit the vulnerability by crafting a URL or POST request containing malicious JavaScript in the notification_urls field. Successful exploitation results in script execution that can modify page content or perform limited actions within the victim's browser session, though the CVSS vector indicates no confidentiality or availability impact.
The project security advisory and associated commits state that the vulnerability is resolved in version 0.45.22, with no workarounds identified. Administrators are advised to upgrade promptly to eliminate the reflected XSS vector.
The associated EPSS score reached a peak of 0.2769 before receding to its current value of 0.2494.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-1730
Vulnerability details
changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. In affected versions Input in parameter notification_urls is not processed resulting in javascript execution in the application. A reflected XSS vulnerability happens when…
more
the user input from a URL or POST data is reflected on the page without being stored, thus allowing the attacker to inject malicious content. This issue has been addressed in version 0.45.22. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.