PT-2024-19004 · Forcepoint · Forcepoint Email Security

Published 2024-09-04 · Updated 2024-09-12 · CVE-2024-2166

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Forcepoint Email Security versions prior to 8.5.5 HF003

Description The issue is related to improper neutralization of input during web page generation, which allows Reflected XSS. This is due to improper input handling in the Real Time Monitor modules of Forcepoint Email Security.

Recommendations For versions prior to 8.5.5 HF003, update to version 8.5.5 HF003 or later to resolve the issue. As a temporary workaround, consider restricting access to the Real Time Monitor modules until a patch is applied. Avoid using potentially vulnerable input parameters in the affected modules to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-2166

Affected Products

Forcepoint Email Security

References · 8

• https://osv.dev/vulnerability/CVE-2024-2166 · Vendor Advisory
• https://support.forcepoint.com/s/article/000042397 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2166 · Security Note
• https://twitter.com/RsSI47041968/status/1831747761512886489 · Twitter Post
• https://twitter.com/CVEnew/status/1831450014226510023 · Twitter Post
• https://twitter.com/CveFindCom/status/1831452610894659761 · Twitter Post
• https://t.me/cvenotify/93263 · Telegram Post
• https://t.me/cvedetector/4873 · Telegram Post