CVE-2026-2344

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2344", "assignerOrgId": "64c5ae8f-7972-4697-86a0-7ada793ac795", "state": "PUBLISHED", "assignerShortName": "TCS-CERT", "dateReserved": "2026-02-11T14:36:10.726Z", "datePublished": "2026-02-11T14:53:20.753Z", "dateUpdated": "2026-02-11T21:19:41.145Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Plunet BusinessManager", "vendor": "Plunet", "versions": [{"status": "affected", "version": "10.15.1"}, {"status": "unaffected", "version": "10.20"}]}], "datePublic": "2026-02-11T14:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A vulnerability in Plunet Plunet BusinessManager allows unauthorized actions being performed on behalf of privileged users.<p>This issue affects Plunet BusinessManager: 10.15.1</p>"}], "value": "A vulnerability in Plunet Plunet BusinessManager allows unauthorized actions being performed on behalf of privileged users.This issue affects Plunet BusinessManager: 10.15.1"}], "impacts": [{"descriptions": [{"lang": "en", "value": "unauthorized actions being performed on behalf of privileged users"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.6, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 - XSS", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "64c5ae8f-7972-4697-86a0-7ada793ac795", "shortName": "TCS-CERT", "dateUpdated": "2026-02-11T14:53:20.753Z"}, "references": [{"url": "https://cds.thalesgroup.com/en/tcs-cert/CVE-2026-2344"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Upgrade <b>Plunet BusinessManager</b> to version <strong>10.20</strong>&nbsp;or later, which includes a fix for the identified cross-site scripting vulnerabilities.\n\n<br>"}], "value": "Upgrade Plunet BusinessManager to version 10.20\u00a0or later, which includes a fix for the identified cross-site scripting vulnerabilities."}], "source": {"discovery": "UNKNOWN"}, "title": "Stored XSS on Plunet BusinessManager", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-11T21:19:35.723887Z", "id": "CVE-2026-2344", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T21:19:41.145Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2344", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-11T21:19:35.723887Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T21:19:38.684Z"}}], "cna": {"title": "Stored XSS on Plunet BusinessManager", "source": {"discovery": "UNKNOWN"}, "impacts": [{"descriptions": [{"lang": "en", "value": "unauthorized actions being performed on behalf of privileged users"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Plunet", "product": "Plunet BusinessManager", "versions": [{"status": "affected", "version": "10.15.1"}, {"status": "unaffected", "version": "10.20"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade Plunet BusinessManager to version 10.20\u00a0or later, which includes a fix for the identified cross-site scripting vulnerabilities.", "supportingMedia": [{"type": "text/html", "value": "Upgrade <b>Plunet BusinessManager</b> to version <strong>10.20</strong>&nbsp;or later, which includes a fix for the identified cross-site scripting vulnerabilities.\n\n<br>", "base64": false}]}], "datePublic": "2026-02-11T14:00:00.000Z", "references": [{"url": "https://cds.thalesgroup.com/en/tcs-cert/CVE-2026-2344"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability in Plunet Plunet BusinessManager allows unauthorized actions being performed on behalf of privileged users.This issue affects Plunet BusinessManager: 10.15.1", "supportingMedia": [{"type": "text/html", "value": "A vulnerability in Plunet Plunet BusinessManager allows unauthorized actions being performed on behalf of privileged users.<p>This issue affects Plunet BusinessManager: 10.15.1</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 - XSS"}]}], "providerMetadata": {"orgId": "64c5ae8f-7972-4697-86a0-7ada793ac795", "shortName": "TCS-CERT", "dateUpdated": "2026-02-11T14:53:20.753Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2344", "state": "PUBLISHED", "dateUpdated": "2026-02-11T21:19:41.145Z", "dateReserved": "2026-02-11T14:36:10.726Z", "assignerOrgId": "64c5ae8f-7972-4697-86a0-7ada793ac795", "datePublished": "2026-02-11T14:53:20.753Z", "assignerShortName": "TCS-CERT"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Plunet BusinessManager", "vendor": "Plunet", "versions": [{"status": "affected", "version": "10.15.1"}, {"status": "unaffected", "version": "10.20"}]}], "source": "64c5ae8f-7972-4697-86a0-7ada793ac795"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in Plunet Plunet BusinessManager allows unauthorized actions being performed on behalf of privileged users.This issue affects Plunet BusinessManager: 10.15.1"}, {"lang": "es", "value": "Una vulnerabilidad en Plunet Plunet BusinessManager permite que se realicen acciones no autorizadas en nombre de usuarios privilegiados. Este problema afecta a Plunet BusinessManager: 10.15.1"}], "id": "CVE-2026-2344", "lastModified": "2026-06-17T10:30:48.973", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "64c5ae8f-7972-4697-86a0-7ada793ac795", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2344", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-11T21:19:35.723887Z", "version": "2.0.3"}}]}, "published": "2026-02-11T15:16:17.993", "references": [{"source": "64c5ae8f-7972-4697-86a0-7ada793ac795", "url": "https://cds.thalesgroup.com/en/tcs-cert/CVE-2026-2344"}], "sourceIdentifier": "64c5ae8f-7972-4697-86a0-7ada793ac795", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "64c5ae8f-7972-4697-86a0-7ada793ac795", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "10.15.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "10.20"}}], "product": "business_manager", "vendor": "plunet"}], "analysis": {"en": {"generated_at": "2026-04-18T19:42:14.630512+00:00", "value": {"mitigation_remediation": ["Upgrade Plunet BusinessManager to version 10.20 or later, which includes the vendor\u2019s fix.", "Sanitize all user\u2011supplied data using a whitelist approach and enforce proper output encoding before rendering that data in browsers.", "Deploy a Content Security Policy that restricts script execution and consider a web application firewall to block malicious payloads.", "Limit or monitor the privileges of users who can submit data until the patch is applied."], "summary": {"action": "Immediate Patch", "impact": "Stored cross\u2011site scripting enabling unauthorized actions on behalf of privileged users"}, "threat_synthesis": {"affected_systems": "Affected product: Plunet BusinessManager, version\u00a010.15.1. The vendor published a fix in version\u00a010.20 and later; earlier releases are not listed as vulnerable.", "description_and_impact": "A stored cross\u2011site scripting flaw has been identified in Plunet BusinessManager. Malicious JavaScript can be entered by an attacker, stored in the system, and later displayed in browsers of other users. The description states that this flaw allows attackers to perform unauthorized actions on behalf of privileged users, implying that the injected code can execute with the victim\u2019s session privileges. The root cause is not explicitly provided, but the nature of the defect suggests that input is not properly sanitized or encoded before being rendered, an inference drawn from the wording of the description.", "risk_and_exploitability": "The CVSS score of\u00a08.6 classifies the vulnerability as high severity. The EPSS score is below\u00a01%, indicating that current exploitation is unlikely, yet the flaw remains dangerous if an attacker can inject payloads. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to reach an input interface that accepts data\u2014potentially an authenticated user or any entity able to submit information\u2014to embed malicious scripts that will execute in other users\u2019 browsers."}}}}, "created": "2026-02-11T21:38:02.932362+00:00", "updated": "2026-04-18T19:45:08.976511+00:00", "vendors": ["plunet", "plunet$PRODUCT$business_manager"]}