Reflected XSS vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary JavaScript code via the "erro" parameter.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Celk
  • Celk Saude

Configuration 1 [-]

cpe:2.3:a:celk:celk_saude:3.1.252.1:*:*:*:*:*:*:*

No data.

References
Link Providers
https://github.com/gabriel-bri/vulnerability-research/tree/main/CVE-2024-48761 cve-icon cve-icon cve-icon
History

Fri, 23 May 2025 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Celk
Celk celk Saude
CPEs cpe:2.3:a:celk:celk_saude:3.1.252.1:*:*:*:*:*:*:*
Vendors & Products Celk
Celk celk Saude

Thu, 03 Apr 2025 15:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-77

Thu, 03 Apr 2025 15:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-79
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 18 Mar 2025 17:15:00 +0000

Type Values Removed Values Added
Description The specific component in Celk Saude 3.1.252.1 that processes user input and returns error messages to the client is vulnerable due to improper validation or sanitization of the "erro" parameter. This parameter appears as a response when incorrect credentials are entered during login. The lack of proper validation or sanitization makes the component susceptible to injection attacks, potentially allowing attackers to manipulate the input and exploit the system. Reflected XSS vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary JavaScript code via the "erro" parameter.

Mon, 03 Feb 2025 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-77
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 29 Jan 2025 22:00:00 +0000

Type Values Removed Values Added
Description The specific component in Celk Saude 3.1.252.1 that processes user input and returns error messages to the client is vulnerable due to improper validation or sanitization of the "erro" parameter. This parameter appears as a response when incorrect credentials are entered during login. The lack of proper validation or sanitization makes the component susceptible to injection attacks, potentially allowing attackers to manipulate the input and exploit the system.
References
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2025-01-29T00:00:00.000Z

Updated: 2025-04-03T15:04:49.593Z

Reserved: 2024-10-08T00:00:00.000Z

Link: CVE-2024-48761

cve-icon Vulnrichment

Updated: 2025-02-03T18:38:49.859Z

cve-icon NVD

Status : Analyzed

Published: 2025-01-29T22:15:29.430

Modified: 2025-05-23T15:26:18.807

Link: CVE-2024-48761

cve-icon Redhat

No data.