CVE-2024-33670
low-risk
Published 2024-04-26
Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript due to Content Security Policy (CSP) restrictions, it may still impact the appearance and user interaction of the page.
Do I need to act?
-
0.46% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.3/10
Medium
NETWORK
/ LOW complexity
Affected Products (1)
Passbolt Api
Affected Vendors
References (6)
Issue Tracking
https://www.passbolt.com/incidents
Issue Tracking
https://www.passbolt.com/incidents
25
/ 100
low-risk
Severity
18/34 · Moderate
Exploitability
2/34 · Minimal
Exposure
5/34 · Minimal