CVE-2024-57348 Details
Description
Cross Site Scripting vulnerability in PecanProject pecan through v.1.8.0 allows a remote attacker to execute arbitrary code via the crafted payload to the hostname, sitegroupid, lat, lon and sitename parameters.
A cross-site scripting (XSS) vulnerability has been identified in PecanProject Pecan, affecting versions through 1.8.0. This vulnerability allows remote attackers to execute arbitrary code by injecting malicious payloads into the hostname, sitegroupid, lat, lon, and sitename parameters. The injected scripts are executed in the context of the user's browser, potentially leading to session hijacking by stealing cookies.
To mitigate this vulnerability, ensure that sensitive cookies are marked as HttpOnly, implement a Content Security Policy to restrict script sources, and sanitize user input while encoding output to prevent script execution.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 18, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/PecanProject/pecan/issues/3400 | [email protected] | ExploitIssue Tracking |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| pecanproject pecan | <= 1.8.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 2, 2025 | Initial Analysis | [email protected] |
| Mar 18, 2025 | CVE Modified | CISA-ADP |
| Mar 13, 2025 | CVE Modified | [email protected] |
| Mar 13, 2025 | New CVE Received | [email protected] |