CVE-2024-11479

Authenticated HTML Injection in Issuetrak Ticket Comment Function

State: Published
Severity: 5.1 Medium
Published: Dec 4, 2024
Updated: Dec 4, 2024
Reserved: Nov 20, 2024

Description

A HTML Injection vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user. HTML markup could be added to comments of tickets, which when submitted will render in the emails sent to all users on that ticket.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	Gridware

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation
CWE-80 HTML Injection

Affected Products

Product	Versions
IssuetrakIssuetrak	Issuetrak 17.1Affected

References

https://helpcenter.issuetrak.com/home/2340-issuetrak-release-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.