CVE-2024-9188

CVE-2024-9188 is a cross-site scripting (XSS) vulnerability, classified under CWE-79, where specially constructed queries trigger cross-platform scripting that leaks administrator tokens. It affects Arista Networks products, as indicated by the vendor's security advisory. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting high severity due to its potential for significant impact.

An unauthenticated remote attacker can exploit this vulnerability over the network with low complexity by tricking a user into processing a malicious query, which requires user interaction. Successful exploitation leaks administrator tokens, enabling high confidentiality, integrity, and availability impacts, potentially allowing attackers to escalate privileges or further compromise the affected system.

Arista's security advisory (https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105) provides details on the vulnerability, including recommended mitigations and patches for affected products. Security practitioners should consult this advisory for version-specific remediation steps.