CVE-2024-54998
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
MonicaHQ version 4.1.2 was found to have an authenticated Client-Side Injection vulnerability via the Reason parameter at /people/h:[id]/debts/create.
Risk Assessment
An authenticated attacker can inject malicious JavaScript code, potentially leading to session theft, account takeover, or data leakage of other users.
Recommendation
Update MonicaHQ to the latest version and implement input validation and encoding for the Reason parameter.
Other vulnerabilities in MonicaHQ
See all- CVE-2024-54999Medium
MonicaHQ v4.1.2 was discovered to contain a Client-Side Injection vulnerability via the last_name parameter in the General Information module.
- CVE-2024-54997Medium
MonicaHQ version 4.1.1 was found to have an authenticated Client-Side Injection vulnerability. The flaw exists in the entry text field at /journal/entries/ID/edit.
- CVE-2024-54996High
MonicaHQ version 4.1.2 was found to contain multiple authenticated Client-Side Injection vulnerabilities. The flaws exist in the title and description parameters at the /people/ID/reminders/create endpoint.
- CVE-2024-54994Medium
MonicaHQ version 4.1.2 was found to contain multiple Client-Side Injection vulnerabilities. The flaws exist in the first_name and last_name parameters of the Add a new relationship feature.
Original NVD description (English source)
MonicaHQ v4.1.2 was discovered to contain an authenticated Client-Side Injection vulnerability via the Reason parameter at /people/h:[id]/debts/create.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS