Lucene search

INCIBEVULNRICHMENT:CVE-2024-4026

HistoryApr 22, 2024 - 11:51 a.m.

CVE-2024-4026 Cross-Site Scripting in the Holded application

2024-04-2211:51:25

CWE-79

INCIBE

github.com

cross-site scripting

holded application

javascript payload

session takeover

CVSS3

4.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

AI Score

5.7

Confidence

High

EPSS

Percentile

9.0%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Cross-Site Scripting (XSS) vulnerability in the Holded application. This vulnerability could allow an attacker to store a JavaScript payload within all editable parameters within the ‘General’ and ‘Team ID’ functionalities, which could result in a session takeover.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:holded:holded:0:*:*:*:*:*:*:*"
    ],
    "vendor": "holded",
    "product": "holded",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "4.20.0",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-holded-application