CVE-2024-34335
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
ORDAT FOSS-Online before version 2.24.01 was discovered to contain a reflected XSS vulnerability on the login page. An attacker can inject malicious script via a crafted request.
Risk Assessment
The risk includes session hijacking, redirection to malicious sites, or unauthorized actions performed in the victim's context.
Recommendation
Immediately update ORDAT FOSS-Online to version 2.24.01 or later, which includes a fix for this vulnerability.
Other vulnerabilities in ORDAT FOSS-Online
See all- CVE-2024-34336Medium
User enumeration vulnerability in ORDAT FOSS-Online before v2.24.01 allows attackers to determine if an account exists by comparing server responses from the forgot password functionality.
- CVE-2024-34334High
A SQL injection vulnerability was discovered in the forgot password function of ORDAT FOSS-Online before version 2.24.01. Attackers can exploit this flaw to manipulate database queries.
Original NVD description (English source)
ORDAT FOSS-Online before version 2.24.01 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the login page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS