CVE-2024-52887— Self-XSS
Quick assessment
Affected
checkpoint Check Point Mobile Access
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Check Point Mobile Access是以色列Check Point公司的一种安全简便的解决方案。用于智能手机、平板电脑或个人计算机通过 Internet 安全地连接到企业应用程序。 Check Point Mobile Access R82及之前版本存在安全漏洞，该漏洞源于经过身份验证的最终用户可以设置特制SNX书签，可能导致浏览器在访问书签列表时运行脚本。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-52887
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Self-XSS
Source: CVE Program / CVE List V5
Vulnerability Description
Authenticated end-user may set a specially crafted SNX bookmark that can make their browser run a script while accessing their own bookmark list.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Check Point Mobile Access 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Check Point Mobile Access是以色列Check Point公司的一种安全简便的解决方案。用于智能手机、平板电脑或个人计算机通过 Internet 安全地连接到企业应用程序。 Check Point Mobile Access R82及之前版本存在安全漏洞，该漏洞源于经过身份验证的最终用户可以设置特制SNX书签，可能导致浏览器在访问书签列表时运行脚本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| checkpoint | Check Point Mobile Access | Check Point Mobile Access versions R81.10, R81.20, R82 | - |
|
II. Public POCs for CVE-2024-52887
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-52887
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-52887 (1)
IV. Related Vulnerabilities
Same vendor: checkpoint
-
CVE-2026-93616
Directory Traversal and File upload allows execution of arbi -
CVE-2026-91843
Stack overflow in login process to the Security Management a -
CVE-2026-85103
Heap-based Buffer Overflow in VPN Certificate ASN.1 Decoding -
CVE-2026-85102
Improper Certificate Validation in Quantum Security Gateway -
CVE-2026-18574
Authentication Bypass in Check Point Security Management Ser
Same weakness: CWE-79
-
CVE-2026-102626
LimeSurvey Community Edition 7.4.0 - Stored XSS through the -
CVE-2026-104847
ProseMirror: XSS vulnerability in prosemirror-view's paste h -
CVE-2026-104907
MISP: JavaScript Injection via Remote Tag ID in Event Previe -
CVE-2026-104906
MISP TAXII Object Viewer Stored XSS via Unescaped JSON Outpu -
CVE-2026-104901
MISP ID Translator: Unescaped Remote Event ID Enables Cross-
V. Comments for CVE-2024-52887
No comments yet