High · 8.3 CVE-2024-22397 EUVD-2024-19953GHSA-x7hw-jwrw-qw78

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the SonicOS SSLVPN portal allows a remote authentic…

Published Mar 14, 2024 · Updated Mar 27, 2025 · Assigned by sonicwall

Vendor: SonicWall Product: SonicOS Category: Network devices

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the SonicOS SSLVPN portal allows a remote authenticated attacker as a firewall 'admin' user to store and execute arbitrary JavaScript code.

Affected products

Vendor	Product	Affected	Fixed
SonicWall	SonicOS	7.0.1-5145 and earlier versions, 7.1.1-7047 and earlier versions	—

Advisories 1

WID-SEC-2024-0610 SonicWall SonicOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 24, 2024

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0005 vendor-advisory