CVE-2024-32492
HIGHCVSS 7.1/10EPSS 0.53%
Last modified
CVE-2024-32492 is a high-severity vulnerability rated 7.1/10 on the CVSS scale. An issue was discovered in Znuny 7.0.1 through 7.0.16 where the ticket detail view in the customer front allows the execution of external JavaScript.. EPSS estimates a 0.53% chance of exploitation in the next 30 days.
Description
An issue was discovered in Znuny 7.0.1 through 7.0.16 where the ticket detail view in the customer front allows the execution of external JavaScript.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Znuny | Znuny | >= 7.0.1, <= 7.0.16 |
References
- https://www.znuny.org/en/advisories/zsa-2024-02Vendor Advisory
- https://znuny.comProduct
- https://www.znuny.org/en/advisories/zsa-2024-02Vendor Advisory
- https://znuny.comProduct
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-32492?
An issue was discovered in Znuny 7.0.1 through 7.0.16 where the ticket detail view in the customer front allows the execution of external JavaScript.
How severe is CVE-2024-32492?
CVE-2024-32492 has a CVSS score of 7.1/10 (HIGH severity). The EPSS model estimates a 0.53% probability of exploitation in the next 30 days.
How do I fix CVE-2024-32492?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-32485Improper Input Validation in some Intel(R) VROC software bef…5.5
- CVE-2024-32487less through 653 allows OS command execution via a newline c…8.6
- CVE-2024-32488In Foxit PDF Reader and Editor before 2024.1, Local Privileg…7.8
- CVE-2024-32489TCPDF before 6.7.4 mishandles calls that use HTML syntax.6.1
- CVE-2024-3249The Zita Elementor Site Library plugin for WordPress is vuln…4.3
- CVE-2024-32491An issue was discovered in Znuny and Znuny LTS 6.0.31 throug…9.8
- CVE-2024-32493An issue was discovered in Znuny LTS 6.5.1 through 6.5.7 and…8.8
- CVE-2024-32498An issue was discovered in OpenStack Cinder through 24.0.0, …6.5
- CVE-2024-32499Newforma Project Center Server through 2023.3.0.32259 allows…9.8
- CVE-2024-3250It was discovered that Canonical's Pebble service manager re…6.5
- CVE-2024-32501A SQL Injection vulnerability exists in the updateServiceHos…9.8
- CVE-2024-32502An issue was discovered in Samsung Mobile Processor and Wear…8.4
Are you affected by CVE-2024-32492?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST