CVE-2024-27708

An attacker can inject a malicious iframe element via an unsecured 'src' parameter in the MyNET application. The vulnerability falls under the category of CWE-74 (Improper Neutralization of Special Elements) and CWE-75 (Failure to Sanitize Special Elements), which means the application does not properly filter input data passed in this parameter. The attack vector is network-based, does not require authentication, but requires user interaction (e.g., clicking on a crafted link), and the attack scope extends beyond the original application (Scope: Changed).

Successful exploitation of the vulnerability allows an attacker to execute arbitrary code in the context of the victim's browser, which may lead to complete session takeover, disclosure of sensitive data, or further attacks on the organization's infrastructure.

Patches available from the vendor should be applied in accordance with the references. It is recommended to update the MyNET application to a version newer than 26.06 and verify the correctness of the 'src' parameter filtering after the update is deployed.

Airc MyNET in version 26.06 and all earlier versions.