CVE-2024-7269
Stored XSS in ConnX ESP HR Management
- State
- Published
- Severity
- 8.7 High
- Published
- Aug 28, 2024
- Updated
- Aug 28, 2024
- Reserved
- Jul 30, 2024
Description
Improper Neutralization of Input During Web Page Generation vulnerability in "Update of Personal Details" form in ConnX ESP HR Management allows Stored XSS attack. An attacker might inject a script to be run in user's browser. After multiple attempts to contact the vendor we did not receive any answer. The finder provided the information that this issue affects ESP HR Management versions before 6.6.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | CERT-PL |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
ESP HR ManagementConnX |
|
References
- https://cert.pl/en/posts/2024/08/CVE-2024-7269/third-party-advisory
- https://cert.pl/posts/2024/08/CVE-2024-7269/third-party-advisory
- https://connx.com.au/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.