{"id":"CVE-2024-21550","aliases":["EUVD-2024-19199","GHSA-g97m-fwww-wqf3"],"status":"published","title":"SteVe is an open platform that implements different version of the OCPP protocol for Electric...","description":"SteVe is an open platform that implements different version of the OCPP protocol for Electric Vehicle charge points, acting as a central server for management of registered charge points. Attackers can inject arbitrary HTML and Javascript code via WebSockets leading to persistent Cross-Site Scripting in the SteVe management interface.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00399,"percentile":0.34628,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2024-08-12T14:54:36Z","modified":"2026-10-28T02:30:24Z","products":[{"vendor":"steve-community","product":"steve"}],"references":[{"url":"https://github.com/steve-community/steve/blob/steve-3.6.0/src/main/java/de/rwth/idsg/steve/config/WebSocketConfiguration.java#L69","tags":["Product","web"]},{"url":"https://github.com/steve-community/steve/issues/1526","tags":["Issue Tracking","Patch","report"]},{"url":"https://github.com/steve-community/steve/pull/1527","tags":["Issue Tracking","Patch","fix"]},{"url":"https://github.com/steve-community/steve/commit/a79983f843c37705182c8f54eba060c1dce3b6d1","tags":["Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21550","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g97m-fwww-wqf3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21550.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-21550","description":"SteVe is an open platform that implements different version of the OCPP protocol for Electric Vehicle charge points, acting as a central server for management of registered charge points. Attackers can inject arbitrary HTML and Javascript code via WebSockets leading to persistent Cross-Site Scripting in the SteVe management interface.","status":"published","published":"2024-08-12T14:54:36.075Z","modified":"2024-08-12T15:20:03.103Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:04.681315Z"}],"euvd":[{"id":"EUVD-2024-19199","description":"SteVe is an open platform that implements different version of the OCPP protocol for Electric Vehicle charge points, acting as a central server for management of registered charge points. Attackers can inject arbitrary HTML and Javascript code via WebSockets leading to persistent Cross-Site Scripting in the SteVe management interface.","status":"published","published":"2024-08-12T14:54:36Z","modified":"2024-08-12T15:20:03Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:56:20.205836Z"}],"ghsa":[{"id":"GHSA-g97m-fwww-wqf3","title":"SteVe is an open platform that implements different version of the OCPP protocol for Electric...","description":"SteVe is an open platform that implements different version of the OCPP protocol for Electric Vehicle charge points, acting as a central server for management of registered charge points. Attackers can inject arbitrary HTML and Javascript code via WebSockets leading to persistent Cross-Site Scripting in the SteVe management interface.","status":"published","published":"2024-08-12T15:30:53Z","modified":"2024-08-12T15:31:05Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:57:55.768435Z"}],"nvd":[{"id":"CVE-2024-21550","description":"SteVe is an open platform that implements different version of the OCPP protocol for Electric Vehicle charge points, acting as a central server for management of registered charge points. Attackers can inject arbitrary HTML and Javascript code via WebSockets leading to persistent Cross-Site Scripting in the SteVe management interface.","status":"published","published":"2024-08-12T15:15:19.903Z","modified":"2026-06-17T07:09:43.51Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:18.563492Z"}],"osv":[{"id":"CVE-2024-21550","description":"SteVe is an open platform that implements different version of the OCPP protocol for Electric Vehicle charge points, acting as a central server for management of registered charge points. Attackers can inject arbitrary HTML and Javascript code via WebSockets leading to persistent Cross-Site Scripting in the SteVe management interface.","status":"published","published":"2024-08-12T14:54:36.075Z","modified":"2026-10-28T02:30:24.229033284Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:38.577405Z"}]}}