CVE-2026-2344 - Vulnerability Details - OpenCVE

A vulnerability in Plunet Plunet BusinessManager allows unauthorized actions being performed on behalf of privileged users.This issue affects Plunet BusinessManager: 10.15.1

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://cds.thalesgroup.com/en/tcs-cert/CVE-2026-2344

History

Wed, 11 Feb 2026 15:15:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability in Plunet Plunet BusinessManager allows unauthorized actions being performed on behalf of privileged users.This issue affects Plunet BusinessManager: 10.15.1
Title		Stored XSS on Plunet BusinessManager
Weaknesses		CWE-79
References		https://cds.thalesgroup.com/en/tcs-cert/CVE-2026-2344
Metrics		cvssV4_0 `{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: TCS-CERT

Published: 2026-02-11T14:53:20.753Z

Updated: 2026-02-11T21:19:41.145Z

Reserved: 2026-02-11T14:36:10.726Z

Link: CVE-2026-2344

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-02-11T15:16:17.993

Modified: 2026-02-11T15:27:26.370

Link: CVE-2026-2344

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2344", "assignerOrgId": "64c5ae8f-7972-4697-86a0-7ada793ac795", "state": "PUBLISHED", "assignerShortName": "TCS-CERT", "dateReserved": "2026-02-11T14:36:10.726Z", "datePublished": "2026-02-11T14:53:20.753Z", "dateUpdated": "2026-02-11T21:19:41.145Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Plunet BusinessManager", "vendor": "Plunet", "versions": [{"status": "affected", "version": "10.15.1"}, {"status": "unaffected", "version": "10.20"}]}], "datePublic": "2026-02-11T14:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A vulnerability in Plunet Plunet BusinessManager allows unauthorized actions being performed on behalf of privileged users.<p>This issue affects Plunet BusinessManager: 10.15.1</p>"}], "value": "A vulnerability in Plunet Plunet BusinessManager allows unauthorized actions being performed on behalf of privileged users.This issue affects Plunet BusinessManager: 10.15.1"}], "impacts": [{"descriptions": [{"lang": "en", "value": "unauthorized actions being performed on behalf of privileged users"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.6, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 - XSS", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "64c5ae8f-7972-4697-86a0-7ada793ac795", "shortName": "TCS-CERT", "dateUpdated": "2026-02-11T14:53:20.753Z"}, "references": [{"url": "https://cds.thalesgroup.com/en/tcs-cert/CVE-2026-2344"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Upgrade <b>Plunet BusinessManager</b> to version <strong>10.20</strong> or later, which includes a fix for the identified cross-site scripting vulnerabilities.\n\n<br>"}], "value": "Upgrade Plunet BusinessManager to version 10.20\u00a0or later, which includes a fix for the identified cross-site scripting vulnerabilities."}], "source": {"discovery": "UNKNOWN"}, "title": "Stored XSS on Plunet BusinessManager", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-11T21:19:35.723887Z", "id": "CVE-2026-2344", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T21:19:41.145Z"}}]}}