CVE-2024-22220

Опубликовано: 21 фев. 2024

Источник: nvd

CVSS3: 6.3

EPSS Низкий

Описание

An issue was discovered in Terminalfour 7.4 through 7.4.0004 QP3 and 8 through 8.3.19, and Formbank through 2.1.10-FINAL. Unauthenticated Stored Cross-Site Scripting can occur, with resultant Admin Session Hijacking. The attack vectors are Form Builder and Form Preview.

Ссылки

https://docs.terminalfour.com/articles/release-notes-highlights/
Release Notes
https://docs.terminalfour.com/release-notes/security-notices/cve-2024-22220/
Vendor Advisory
https://docs.terminalfour.com/articles/release-notes-highlights/
Release Notes
https://docs.terminalfour.com/release-notes/security-notices/cve-2024-22220/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:terminalfour:formbank:*:*:*:*:*:*:*:*

Версия до 2.1.10 (включая)

cpe:2.3:a:terminalfour:terminalfour:*:*:*:*:*:*:*:*

Версия от 7.4 (включая) до 7.4.0004 (исключая)

cpe:2.3:a:terminalfour:terminalfour:*:*:*:*:*:*:*:*

Версия от 8.0.0 (включая) до 8.3.19 (включая)

cpe:2.3:a:terminalfour:terminalfour:7.4.0004:qp2:*:*:*:*:*:*

cpe:2.3:a:terminalfour:terminalfour:7.4.0004:qp3:*:*:*:*:*:*

EPSS

Процентиль: 51%

0.00276

Низкий

6.3 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-mmq5-phxp-hrxq