CVE-2024-56882: XSS
Published Feb 18, 2025
·Updated
Sage DPW before 202412000 is vulnerable to Cross Site Scripting (XSS). Low-privileged Sage users with employee role privileges can permanently store JavaScript code in the Kurstitel and Kurzinfo input fields. The injected payload is executed for each authenticated user who views and interacts with the modified data elements.
Affected Software
2 affected components
Sage DPW<2024_12_000
Sagedpw Sage Dpw<2024_12_000
Event History
Feb 18, 2025
CVE Published
via NVD·06:15 PM
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-56882?
CVE-2024-56882 is classified as a low severity vulnerability.
2
How do I fix CVE-2024-56882?
To fix CVE-2024-56882, upgrade to Sage DPW version 2024_12_000 or later.
3
Who is affected by CVE-2024-56882?
Low-privileged Sage users with employee role privileges are affected by CVE-2024-56882.
4
What type of vulnerability is CVE-2024-56882?
CVE-2024-56882 is a Cross Site Scripting (XSS) vulnerability.
5
What can attackers do with CVE-2024-56882?
Attackers can inject JavaScript code in input fields that can execute when viewed by authenticated users.