CVE-2024-42904: XSS
Published Sep 3, 2024
·Updated
A cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter at /Controllers/ClientController.php.
Affected Software
1 affected component
sysPass SysPass>=3.2.0<=3.2.11
Event History
Sep 3, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·06:15 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2024-42904?
The severity of CVE-2024-42904 is classified as medium due to its potential for cross-site scripting (XSS) attacks.
2
How do I fix CVE-2024-42904?
To fix CVE-2024-42904, update SysPass to version 3.2.12 or later to mitigate the XSS vulnerability.
3
What versions of SysPass are affected by CVE-2024-42904?
CVE-2024-42904 affects SysPass versions 3.2.0 to 3.2.11 inclusive.
4
What type of attack is CVE-2024-42904 associated with?
CVE-2024-42904 is associated with a cross-site scripting (XSS) attack that allows execution of arbitrary web scripts.
5
Where in the code is CVE-2024-42904 located?
CVE-2024-42904 is located in the name parameter handling within the ClientController.php file of the SysPass application.