CVE-2024-54997
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
MonicaHQ version 4.1.1 was found to have an authenticated Client-Side Injection vulnerability. The flaw exists in the entry text field at /journal/entries/ID/edit.
Risk Assessment
An authenticated attacker can inject malicious JavaScript code, potentially leading to session theft, content modification, or other attacks against users viewing the entries.
Recommendation
Update MonicaHQ to the latest patched version. Until then, restrict access to the entry editing feature to trusted users only.
Other vulnerabilities in MonicaHQ
See all- CVE-2024-54999Medium
MonicaHQ v4.1.2 was discovered to contain a Client-Side Injection vulnerability via the last_name parameter in the General Information module.
- CVE-2024-54998Medium
MonicaHQ version 4.1.2 was found to have an authenticated Client-Side Injection vulnerability via the Reason parameter at /people/h:[id]/debts/create.
- CVE-2024-54996High
MonicaHQ version 4.1.2 was found to contain multiple authenticated Client-Side Injection vulnerabilities. The flaws exist in the title and description parameters at the /people/ID/reminders/create endpoint.
- CVE-2024-54994Medium
MonicaHQ version 4.1.2 was found to contain multiple Client-Side Injection vulnerabilities. The flaws exist in the first_name and last_name parameters of the Add a new relationship feature.
Original NVD description (English source)
MonicaHQ v4.1.1 was discovered to contain an authenticated Client-Side Injection vulnerability via the entry text field at /journal/entries/ID/edit.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS