CVE-2024-37671
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A Cross Site Scripting (XSS) vulnerability in Tessi Docubase Document Management product version 5.x allows a remote attacker to execute arbitrary code via the 'page' parameter.
Risk Assessment
An attacker can inject malicious scripts, leading to user session theft, website defacement, or admin account takeover, compromising data confidentiality and integrity.
Recommendation
Immediately update Tessi Docubase to the latest version and implement input filtering and validation for the 'page' parameter to mitigate XSS attacks.
Other vulnerabilities in Tessi Docubase
See all- CVE-2024-37675Medium
A Cross Site Scripting (XSS) vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via the "sectionContent" parameter in the functionality of adding notes to an uploaded file.
- CVE-2024-37673Medium
A Cross Site Scripting (XSS) vulnerability in Tessi Docubase Document Management product version 5.x allows a remote attacker to execute arbitrary code via the filename parameter.
- CVE-2024-37672Medium
A Cross Site Scripting (XSS) vulnerability in Tessi Docubase Document Management product version 5.x allows a remote attacker to execute arbitrary code via the idactivity parameter.
Original NVD description (English source)
Cross Site Scripting vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via the page parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS