CVE-2024-35322
Reflected XSS in MyNET v26.08 via ficheiro Parameter
Publication date: 2025-12-24
Last updated on: 2025-12-24
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mynet | mynet | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a reflected cross-site scripting (XSS) issue in MyNET up to version 26.08. It occurs via the 'ficheiro' parameter, which allows an attacker to inject malicious scripts that are reflected back to the user, potentially compromising their interaction with the application.
How can this vulnerability impact me? :
The reflected XSS vulnerability can allow attackers to execute malicious scripts in the context of a user's browser session. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed on behalf of the user.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending crafted HTTP requests to the MyNET web application that include malicious scripts in the 'ficheiro' parameter and observing if the script is reflected in the response. For example, you can use curl to send a test request: curl -i "https://your-mynet-domain/MyNetJSON.asp?acc=4&ficheiro=<img src=a onerror=alert(document.domain)>&formtoken=1234566&_tk=" and check if the response contains the injected script. Monitoring web server logs for suspicious requests containing script tags or unusual parameters in 'ficheiro' can also help detect attempts to exploit this vulnerability. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying input validation and sanitization on the 'ficheiro' parameter to prevent injection of malicious scripts. If a patch or update is available from the vendor, apply it promptly. As a temporary measure, you can implement web application firewall (WAF) rules to block requests containing suspicious script patterns in the 'ficheiro' parameter. Additionally, restrict access to the vulnerable interface if possible and monitor for exploitation attempts. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the reflected XSS vulnerability in MyNET affects compliance with standards such as GDPR or HIPAA.