CVE-2024-23186CWE-79

E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices

Medium · published May 6, 2024

CVSS v3.1
6.5
EPSS
1%
Percentile
46.7
In the wild
Unconfirmed
What it is

E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. We now use safer methods of handling external content when embedding displayname information to the web interface. No publicly available exploits are known.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00575 · 46.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-05-06T06:36Z
EPSS history
Timeline
  • 06 MAY 06:36Z
    E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices
    cvelistv5