CVE-2024-49505mediumCWE-79

CVE-2024-49505: medium-severity vulnerability in openSUSE Tumbleweed

XSS vulnerability found in OpenSuse MirrorCache

Published

Follow this CVE+ Monitor Tumbleweed

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.4%
A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in openSUSE Tumbleweed MirrorCache allows the execution of arbitrary JS via reflected XSS in the  REGEX and P parameters. This issue affects MirrorCache before 1.083.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
openSUSE · Tumbleweed
Related CVEs — openSUSE Tumbleweed

In the same product, most dangerous first.

CVE-2021-25315CRITICALsalt-api unauthenticated remote code executionEPSS 2.3%CVE-2022-31250HIGHkeylime %post scriplet allows for privilege escalation from keylime user to rootEPSS 0.3%CVE-2023-32183HIGHCVE-2023-32183EPSS 0.2%CVE-2025-53881MEDIUMSUSE-specific logrotate configuration allows escalation from mail user/group to rootEPSS 0.2%CVE-2025-46810HIGHCVE-2025-46810EPSS 0.2%CVE-2026-104618MEDIUMsdbootutil: world-readable debug logEPSS 0.1%