CVE-2024-50857

low-risk

Published 2025-01-14

The ip_do_job request in GestioIP v3.5.7 is vulnerable to Cross-Site Scripting (XSS). It allows data exfiltration and enables CSRF attacks. The vulnerability requires specific user permissions within the application to exploit successfully.

Do I need to act?

0.06% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

1 public exploit available

52203

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.8/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Gestioip

Affected Vendors

Gestioip

References (4)

Product http://www.gestioip.net

Exploit https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50857

Product https://github.com/muebel/gestioip-docker-compose

Exploit https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50857

/ 100

low-risk

Severity 19/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal