Skip to main content

Workforce Optimization CVE-2024-36395

MEDIUM
Basic XSS (CWE-80)
2024-06-13 cna@cyber.gov.il
XSS Workforce Optimization
6.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.1 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

1
CVE Published
Jun 13, 2024 - 13:15 nvd
MEDIUM 6.1

DescriptionNVD

Verint - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

AnalysisAI

Verint - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-80. Verint - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Affected products include: Verint Workforce Optimization.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Workforce Optimization

View all
CVE-2021-36450 MEDIUM POC
6.1 Dec 15

Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications NEWUINAV parameter. Rated m
CVE-2020-23446 MEDIUM POC
5.3 Sep 22

Verint Workforce Optimization suite 15.1 (15.1.0.37634) has Unauthenticated Information Disclosure via API. Rated medium
CVE-2020-13480 MEDIUM POC
5.4 Jun 22

Verint Workforce Optimization (WFO) 15.2 allows HTML injection via the "send email" feature. Rated medium severity (CVSS
CVE-2021-41825 MEDIUM POC
5.3 Oct 08

Verint Workforce Optimization (WFO) 15.2.5.1033 allows HTML injection via the /wfo/control/signin username parameter. Ra
CVE-2024-36396 HIGH
8.8 Jun 13

Verint - CWE-434: Unrestricted Upload of File with Dangerous Type. Rated high severity (CVSS 8.8), this vulnerability is

Same weakness CWE-80 – Basic XSS

View all
CVE-2025-30210 HIGH POC
8.7
CVE-2025-30161 HIGH POC
8.4
CVE-2024-32484 HIGH POC
8.2
CVE-2026-2995 HIGH POC
7.7
CVE-2024-25639 HIGH POC
7.5
CVE-2022-0989 HIGH POC
7.5
CVE-2024-34507 HIGH POC
7.4
CVE-2024-33423 HIGH POC
7.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8
CVE-2016-8581 MEDIUM POC
6.1

Share

CVE-2024-36395 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy