CVE-2026-2337 - Vulnerability Details - OpenCVE

A vulnerability in Plunet Plunet BusinessManager allows session hijacking, data theft, unauthorized actions on behalf of the user.This issue affects Plunet BusinessManager: 10.15.1.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable yes

Technical Impact total

No data.

No data.

No data.

No data.

References

Link	Providers
https://cds.thalesgroup.com/en/tcs-cert/CVE-2026-2337

History

Wed, 11 Feb 2026 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 11 Feb 2026 14:00:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability in Plunet Plunet BusinessManager allows session hijacking, data theft, unauthorized actions on behalf of the user.This issue affects Plunet BusinessManager: 10.15.1.
Title		Refleccted XSS on Plunet BusinessManager
Weaknesses		CWE-79
References		https://cds.thalesgroup.com/en/tcs-cert/CVE-2026-2337
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: TCS-CERT

Published: 2026-02-11T13:28:30.034Z

Updated: 2026-02-11T14:19:29.316Z

Reserved: 2026-02-11T10:58:48.725Z

Link: CVE-2026-2337

Vulnrichment

Updated: 2026-02-11T14:19:25.479Z

NVD

Status : Awaiting Analysis

Published: 2026-02-11T14:16:02.390

Modified: 2026-02-11T15:27:26.370

Link: CVE-2026-2337

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2337", "assignerOrgId": "64c5ae8f-7972-4697-86a0-7ada793ac795", "state": "PUBLISHED", "assignerShortName": "TCS-CERT", "dateReserved": "2026-02-11T10:58:48.725Z", "datePublished": "2026-02-11T13:28:30.034Z", "dateUpdated": "2026-02-11T14:19:29.316Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Plunet BusinessManager", "vendor": "Plunet", "versions": [{"status": "affected", "version": "10.15.1"}, {"status": "unaffected", "version": "10.22.4"}]}], "datePublic": "2026-02-11T13:20:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A vulnerability in Plunet Plunet BusinessManager allows session hijacking, data theft, unauthorized actions on behalf of the user.<p>This issue affects Plunet BusinessManager: 10.15.1.</p>"}], "value": "A vulnerability in Plunet Plunet BusinessManager allows session hijacking, data theft, unauthorized actions on behalf of the user.This issue affects Plunet BusinessManager: 10.15.1."}], "impacts": [{"descriptions": [{"lang": "en", "value": "session hijacking"}]}, {"descriptions": [{"lang": "en", "value": "data theft"}]}, {"descriptions": [{"lang": "en", "value": "unauthorized actions on behalf of the user"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 - XSS", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "64c5ae8f-7972-4697-86a0-7ada793ac795", "shortName": "TCS-CERT", "dateUpdated": "2026-02-11T13:28:30.034Z"}, "references": [{"url": "https://cds.thalesgroup.com/en/tcs-cert/CVE-2026-2337"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Upgrade <b>Plunet BusinessManager</b> to version <strong>10.22.4</strong> or later, which includes a fix for the identified cross-site scripting vulnerabilities."}], "value": "Upgrade Plunet BusinessManager to version 10.22.4 or later, which includes a fix for the identified cross-site scripting vulnerabilities."}], "source": {"discovery": "UNKNOWN"}, "title": "Refleccted XSS on Plunet BusinessManager", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-11T14:19:22.609703Z", "id": "CVE-2026-2337", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T14:19:29.316Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2337", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-11T14:19:22.609703Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T14:19:25.479Z"}}], "cna": {"title": "Refleccted XSS on Plunet BusinessManager", "source": {"discovery": "UNKNOWN"}, "impacts": [{"descriptions": [{"lang": "en", "value": "session hijacking"}]}, {"descriptions": [{"lang": "en", "value": "data theft"}]}, {"descriptions": [{"lang": "en", "value": "unauthorized actions on behalf of the user"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Plunet", "product": "Plunet BusinessManager", "versions": [{"status": "affected", "version": "10.15.1"}, {"status": "unaffected", "version": "10.22.4"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade Plunet BusinessManager to version 10.22.4 or later, which includes a fix for the identified cross-site scripting vulnerabilities.", "supportingMedia": [{"type": "text/html", "value": "Upgrade <b>Plunet BusinessManager</b> to version <strong>10.22.4</strong> or later, which includes a fix for the identified cross-site scripting vulnerabilities.", "base64": false}]}], "datePublic": "2026-02-11T13:20:00.000Z", "references": [{"url": "https://cds.thalesgroup.com/en/tcs-cert/CVE-2026-2337"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability in Plunet Plunet BusinessManager allows session hijacking, data theft, unauthorized actions on behalf of the user.This issue affects Plunet BusinessManager: 10.15.1.", "supportingMedia": [{"type": "text/html", "value": "A vulnerability in Plunet Plunet BusinessManager allows session hijacking, data theft, unauthorized actions on behalf of the user.<p>This issue affects Plunet BusinessManager: 10.15.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 - XSS"}]}], "providerMetadata": {"orgId": "64c5ae8f-7972-4697-86a0-7ada793ac795", "shortName": "TCS-CERT", "dateUpdated": "2026-02-11T13:28:30.034Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2337", "state": "PUBLISHED", "dateUpdated": "2026-02-11T14:19:29.316Z", "dateReserved": "2026-02-11T10:58:48.725Z", "assignerOrgId": "64c5ae8f-7972-4697-86a0-7ada793ac795", "datePublished": "2026-02-11T13:28:30.034Z", "assignerShortName": "TCS-CERT"}, "dataVersion": "5.2"}