Medium severity6.1NVD Advisory· Published Aug 12, 2024· Updated Jun 17, 2026
CVE-2024-21550
CVE-2024-21550
Description
SteVe is an open platform that implements different version of the OCPP protocol for Electric Vehicle charge points, acting as a central server for management of registered charge points. Attackers can inject arbitrary HTML and Javascript code via WebSockets leading to persistent Cross-Site Scripting in the SteVe management interface.
Affected products
5(expand)+ 3 more
- (no CPE)
- cpe:2.3:a:steve-community:steve:*:*:*:*:*:*:*:*range: <=3.5.1
- cpe:2.3:a:steve-community:steve:3.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:steve-community:steve:3.7.0:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
4- github.com/steve-community/steve/commit/a79983f843c37705182c8f54eba060c1dce3b6d1nvdPatch
- github.com/steve-community/steve/issues/1526nvdIssue TrackingPatch
- github.com/steve-community/steve/pull/1527nvdIssue TrackingPatch
- github.com/steve-community/steve/blob/steve-3.6.0/src/main/java/de/rwth/idsg/steve/config/WebSocketConfiguration.javanvdProduct
News mentions
0No linked articles in our index yet.