Lucene search

TR-CERTVULNRICHMENT:CVE-2024-4754

HistoryJun 24, 2024 - 9:01 a.m.

CVE-2024-4754 Stored XSS in Next4Biz's BPM

2024-06-2409:01:13

CWE-79

TR-CERT

github.com

cve-2024-4754

stored xss

next4biz

bpm

software business process management

crm

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.2%

JSON

Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Next4Biz CRM & BPM Software Business Process Manangement (BPM) allows Stored XSS.This issue affects Business Process Manangement (BPM): from 6.6.4.4 before 6.6.4.5.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Business Process Manangement (BPM)",
    "vendor": "Next4Biz CRM & BPM Software",
    "versions": [
      {
        "lessThan": "6.6.4.5",
        "status": "affected",
        "version": "6.6.4.4",
        "versionType": "custom"
      }
    ]
  }
]

References

www.usom.gov.tr/bildirim/tr-24-0739