CVE-2026-2337

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2337", "assignerOrgId": "64c5ae8f-7972-4697-86a0-7ada793ac795", "state": "PUBLISHED", "assignerShortName": "TCS-CERT", "dateReserved": "2026-02-11T10:58:48.725Z", "datePublished": "2026-02-11T13:28:30.034Z", "dateUpdated": "2026-02-19T08:59:12.567Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Plunet BusinessManager", "vendor": "Plunet", "versions": [{"status": "affected", "version": "10.15.1"}, {"status": "unaffected", "version": "10.22.3"}]}], "datePublic": "2026-02-11T13:20:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A vulnerability in Plunet Plunet BusinessManager allows session hijacking, data theft, unauthorized actions on behalf of the user.<p>This issue affects Plunet BusinessManager: 10.15.1.</p>"}], "value": "A vulnerability in Plunet Plunet BusinessManager allows session hijacking, data theft, unauthorized actions on behalf of the user.This issue affects Plunet BusinessManager: 10.15.1."}], "impacts": [{"descriptions": [{"lang": "en", "value": "session hijacking"}]}, {"descriptions": [{"lang": "en", "value": "data theft"}]}, {"descriptions": [{"lang": "en", "value": "unauthorized actions on behalf of the user"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 - XSS", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "64c5ae8f-7972-4697-86a0-7ada793ac795", "shortName": "TCS-CERT", "dateUpdated": "2026-02-19T08:59:12.567Z"}, "references": [{"url": "https://cds.thalesgroup.com/en/tcs-cert/CVE-2026-2337"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Upgrade <b>Plunet BusinessManager</b> to version <strong>10.22.3</strong>&nbsp;or later, which includes a fix for the identified cross-site scripting vulnerabilities."}], "value": "Upgrade Plunet BusinessManager to version 10.22.3\u00a0or later, which includes a fix for the identified cross-site scripting vulnerabilities."}], "source": {"discovery": "UNKNOWN"}, "title": "Refleccted XSS on Plunet BusinessManager", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-11T14:19:22.609703Z", "id": "CVE-2026-2337", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T14:19:29.316Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2337", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-11T14:19:22.609703Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T14:19:25.479Z"}}], "cna": {"title": "Refleccted XSS on Plunet BusinessManager", "source": {"discovery": "UNKNOWN"}, "impacts": [{"descriptions": [{"lang": "en", "value": "session hijacking"}]}, {"descriptions": [{"lang": "en", "value": "data theft"}]}, {"descriptions": [{"lang": "en", "value": "unauthorized actions on behalf of the user"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Plunet", "product": "Plunet BusinessManager", "versions": [{"status": "affected", "version": "10.15.1"}, {"status": "unaffected", "version": "10.22.3"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade Plunet BusinessManager to version 10.22.3\u00a0or later, which includes a fix for the identified cross-site scripting vulnerabilities.", "supportingMedia": [{"type": "text/html", "value": "Upgrade <b>Plunet BusinessManager</b> to version <strong>10.22.3</strong>&nbsp;or later, which includes a fix for the identified cross-site scripting vulnerabilities.", "base64": false}]}], "datePublic": "2026-02-11T13:20:00.000Z", "references": [{"url": "https://cds.thalesgroup.com/en/tcs-cert/CVE-2026-2337"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability in Plunet Plunet BusinessManager allows session hijacking, data theft, unauthorized actions on behalf of the user.This issue affects Plunet BusinessManager: 10.15.1.", "supportingMedia": [{"type": "text/html", "value": "A vulnerability in Plunet Plunet BusinessManager allows session hijacking, data theft, unauthorized actions on behalf of the user.<p>This issue affects Plunet BusinessManager: 10.15.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 - XSS"}]}], "providerMetadata": {"orgId": "64c5ae8f-7972-4697-86a0-7ada793ac795", "shortName": "TCS-CERT", "dateUpdated": "2026-02-19T08:59:12.567Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2337", "state": "PUBLISHED", "dateUpdated": "2026-02-19T08:59:12.567Z", "dateReserved": "2026-02-11T10:58:48.725Z", "assignerOrgId": "64c5ae8f-7972-4697-86a0-7ada793ac795", "datePublished": "2026-02-11T13:28:30.034Z", "assignerShortName": "TCS-CERT"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Plunet BusinessManager", "vendor": "Plunet", "versions": [{"status": "affected", "version": "10.15.1"}, {"status": "unaffected", "version": "10.22.3"}]}], "source": "64c5ae8f-7972-4697-86a0-7ada793ac795"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in Plunet Plunet BusinessManager allows session hijacking, data theft, unauthorized actions on behalf of the user.This issue affects Plunet BusinessManager: 10.15.1."}, {"lang": "es", "value": "Una vulnerabilidad en Plunet Plunet BusinessManager permite el secuestro de sesi\u00f3n, el robo de datos, acciones no autorizadas en nombre del usuario. Este problema afecta a Plunet BusinessManager: 10.15.1."}], "id": "CVE-2026-2337", "lastModified": "2026-06-17T10:30:48.497", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "64c5ae8f-7972-4697-86a0-7ada793ac795", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2337", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-11T14:19:22.609703Z", "version": "2.0.3"}}]}, "published": "2026-02-11T14:16:02.390", "references": [{"source": "64c5ae8f-7972-4697-86a0-7ada793ac795", "url": "https://cds.thalesgroup.com/en/tcs-cert/CVE-2026-2337"}], "sourceIdentifier": "64c5ae8f-7972-4697-86a0-7ada793ac795", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "64c5ae8f-7972-4697-86a0-7ada793ac795", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "10.15.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "10.22.4"}}], "product": "business_manager", "vendor": "plunet"}], "analysis": {"en": {"generated_at": "2026-04-17T20:21:44.666001+00:00", "value": {"mitigation_remediation": ["Upgrade Plunet BusinessManager to version\u202f10.22.3 or later. ", "Apply input filtering or encoding on all fields that accept user data to neutralize script payloads. ", "Deploy a web application firewall or configure browser security headers (e.g., X\u2011XSS\u2011Protection, Content\u2011Security\u2011Policy) to mitigate remaining XSS risks."], "summary": {"action": "Patch", "impact": "Cross\u2011Site Scripting leading to session hijacking and data theft"}, "threat_synthesis": {"affected_systems": "Plunet BusinessManager, distributed by Plunet, is affected. The flaw resides in version\u202f10.15.1; versions starting with 10.22.3 contain a fix and are no longer vulnerable.", "description_and_impact": "A cross\u2011site scripting flaw exists in Plunet BusinessManager, allowing attackers to inject malicious scripts into the web interface. The vulnerability can result in theft of session cookies, sensitive data, and execution of unauthorized actions on behalf of the user. This is an input validation failure (CWE\u201179).", "risk_and_exploitability": "The CVSS score of 8.7 classifies the issue as high severity. The EPSS score is under 1\u202f%, indicating a very low current exploitation probability, and it is not listed in CISA\u2019s KEV catalog. The likely attack vector is inferred to be web\u2011based, requiring the attacker to deliver malicious payloads through user\u2011supplied input that the application fails to sanitize. If a victim visits a crafted page, the attacker could hijack the session and perform actions with the victim\u2019s authority. While no public exploit is documented, the high severity and potential for automated attacks warrant swift remediation."}}}}, "created": "2026-02-11T21:38:12.775121+00:00", "updated": "2026-04-17T20:30:15.810177+00:00", "vendors": ["plunet", "plunet$PRODUCT$business_manager"]}