CVE-2024-36819: XSS
MAP-OS 4.45.0 and earlier is vulnerable to Cross-Site Scripting (XSS). This vulnerability allows malicious users to insert a malicious payload into the "Client Name" input. When a service order from this client is created, the malicious payload is displayed on the administrator and employee dashboards, resulting in unauthorized script execution whenever the dashboard is loaded.
Affected Software
Remediation
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
A malicious user who can enter a value into the Client Name field can store a script payload. The payload executes for administrators and employees when they load a dashboard that displays a service order for that client.
Does exploitation require user interaction?
Yes. An administrator or employee must load the affected dashboard after a service order associated with the malicious client has been created. The attacker does not need elevated privileges, but does need access to submit the Client Name input.
Which versions are affected?
MAP-OS version 4.45.0 and earlier are affected. A patch is available.