CVE-2024-6516

Cross Site Scripting XSS

Critical9.3EPSS 1.1%

Published: 5 Dec 2024
Updated: 5 Dec 2024
Reserved: 4 Jul 2024
Assigned by: ABB

Description

Cross Site Scripting vulnerabilities where found providing a potential for malicious scripts to be injected into a client browser. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

Scores

CVSS scores of CVE-2024-6516, by who scored it
Scored by	CVSS	Score	Vector
ABBCNA (assigner)	4.0	Critical9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:N/AU:N/R:U/V:D/RE:L/U:Red
ABBCNA (assigner)	3.1	Critical9.0	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
NVDNVD · Analyzed	4.0	Critical9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:L/U:Red

EPSS (exploitation in 30 days): 1.1% · top 35% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.3.

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs

Affected products

ABB · ASPECT-Enterprise
- affected ≤ 3.08.01
ABB · NEXUS Series
- affected ≤ 3.08.01
ABB · MATRIX Series
- affected ≤ 3.08.01

References (1)

https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2024-6516](https://trackcve.app/badge/CVE-2024-6516.svg)](https://trackcve.app/cve/CVE-2024-6516)

Record last updated 5 Dec 2024, 18:50 UTC.