This vulnerability (CVE-2024-12972) affects Akinsoft OctoCloud versions starting from s1.09.01 up to but not including v1.11.01. It is classified as CWE-79, indicating improper neutralization of input during web page generation, leading to Cross-Site Scripting (XSS). The CVSS 3.1 base score is 4.3 (medium severity) with vector AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L, meaning the attack requires network access, low attack complexity, high privileges, and user interaction, and impacts confidentiality, integrity, and availability to a limited extent. There is no vendor advisory or patch information available at this time.

Successful exploitation could allow an attacker with high privileges and requiring user interaction to execute arbitrary scripts in the context of the affected OctoCloud application, potentially leading to limited confidentiality, integrity, and availability impacts. However, the vulnerability is rated medium severity and no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit exposure by restricting high privilege access and educating users to avoid interacting with untrusted content. Monitor vendor channels for updates regarding patches or official mitigations.