CVEvulnerability
CVE-2024-33670
4.3 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2024-04-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-79
Description
Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript due to Content Security Policy (CSP) restrictions, it may still impact the appearance and user interaction of the page.
Affected configurations
• passbolt passbolt api (< 4.6.2)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://help.passbolt.com/incidents/reflective-html-injection-vulnerability Issue Tracking, Vendor Advisory
- https://www.passbolt.com/incidents Issue Tracking, Vendor Advisory
- https://www.passbolt.com/security/more Product
- https://help.passbolt.com/incidents/reflective-html-injection-vulnerability Issue Tracking, Vendor Advisory
- https://www.passbolt.com/incidents Issue Tracking, Vendor Advisory
- https://www.passbolt.com/security/more Product