Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.7

Config Menu Allows Malicious Code to Run in Users' Browsers

CVE-2024-36498 · published 1 year ago
Summary

The configuration menu's 'Edit Disclaimer Text' function is vulnerable to a type of attack that lets an attacker run malicious code in other users' browsers. This can happen even when users are in a restricted 'Kiosk-mode' browser. To protect your users, update to version 7.40 or later.

Original advisory text
Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit Disclaimer Text" function of the config...
Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit Disclaimer Text" function of the configuration menu is vulnerable to stored XSS. Only the users Poweruser and Admin can use this function which is available at the URL









https://$SCANNER/cgi/admin.cgi?-rdisclaimer+-apre

The stored Javascript payload will be executed every time the ScanWizard is loaded, even in the Kiosk-mode browser. Version 7.40 implemented a fix, but it could be bypassed via URL-encoding the Javascript payload again.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.7 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published12 Dec 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-36498 · NVD
Track software like this
Free during beta