CVE-2024-33670

Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL

Medium · published April 26, 2024

CVSS v3.1
4.3
EPSS
0%
Percentile
40.6
In the wild
Unconfirmed
What it is

Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript due to Content Security Policy (CSP) restrictions, it may still impact the appearance and user interaction of the page.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:R
CVSS v4.0
Not supplied
EPSS
0.00482 · 40.6th percentile
Published
2024-04-26T00:00Z
EPSS history
Timeline
  • 26 APR 00:00Z
    Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL
    cvelistv5