CVE-2024-48937
MEDIUMCVSS 6.1/10EPSS 0.36%
Last modified
CVE-2024-48937 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows XSS. JavaScript code in the short description of the SLA field in Activity Dialogues is executed.. EPSS estimates a 0.36% chance of exploitation in the next 30 days.
Description
Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows XSS. JavaScript code in the short description of the SLA field in Activity Dialogues is executed.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Znuny | Znuny | >= 6.0.0, < 6.1.0 |
| Znuny | Znuny | >= 6.5.1, <= 6.5.10 |
| Znuny | Znuny | >= 7.0.1, <= 7.0.16 |
References
- https://www.znuny.comProduct
- https://www.znuny.org/en/advisoriesVendor Advisory
- https://www.znuny.org/en/advisories/zsa-2024-05Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-48937?
Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows XSS. JavaScript code in the short description of the SLA field in Activity Dialogues is executed.
How severe is CVE-2024-48937?
CVE-2024-48937 has a CVSS score of 6.1/10 (MEDIUM severity). The EPSS model estimates a 0.36% probability of exploitation in the next 30 days.
How do I fix CVE-2024-48937?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-4893DigiWin EasyFlow .NET lacks validation for certain input par…9.8
- CVE-2024-48930secp256k1-node is a Node.js binding for an Optimized C libra…8.7
- CVE-2024-48931ZimaOS is a fork of CasaOS, an operating system for Zima dev…7.5
- CVE-2024-48932ZimaOS is a fork of CasaOS, an operating system for Zima dev…5.3
- CVE-2024-48933A cross-site scripting (XSS) vulnerability in LemonLDAP::NG …6.1
- CVE-2024-48936SchedMD Slurm before 24.05.4 has Incorrect Authorization. A …5
- CVE-2024-48938Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.…7.5
- CVE-2024-48939Insufficient validation performed on the REST API License fi…7.5
- CVE-2024-4894ITPison OMICARD EDM fails to properly filter specific URL p…5.3
- CVE-2024-48941The Syracom Secure Login (2FA) plugin for Jira, Confluence, …5.4
- CVE-2024-48942The Syracom Secure Login (2FA) plugin for Jira, Confluence, …5.9
- CVE-2024-48944Server-Side Request Forgery (SSRF) vulnerability in Apache K…6.5
Are you affected by CVE-2024-48937?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST