CVE-2024-25506: XSS
Published Mar 28, 2024
·Updated
Cross Site Scripting vulnerability in Process Maker, Inc ProcessMaker before 4.0 allows a remote attacker to run arbitrary code via control of the pmsyssys cookie.
Affected Software
1 affected component
ProcessMaker ProcessMaker<4.0
Event History
Mar 28, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-25506?
CVE-2024-25506 is classified as a Cross Site Scripting (XSS) vulnerability which can lead to serious security risks if exploited.
2
How do I fix CVE-2024-25506?
To fix CVE-2024-25506, upgrade ProcessMaker to version 4.0 or later, which addresses this vulnerability.
3
What software versions are affected by CVE-2024-25506?
CVE-2024-25506 affects ProcessMaker versions prior to 4.0.
4
What type of attack can be executed through CVE-2024-25506?
CVE-2024-25506 allows a remote attacker to run arbitrary code by manipulating the pm_sys_sys cookie.
5
Who is the vendor for CVE-2024-25506?
The vendor for CVE-2024-25506 is Process Maker, Inc.