PT-2024-20192 · Unknown · Group-Office

Tsutomu Aramaki + 1 · Published 2024-02-01 · Updated 2024-02-06 · CVE-2024-23941

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Group Office versions prior to 6.6.182 Group Office versions prior to 6.7.64 Group Office versions prior to 6.8.31

Description A cross-site scripting issue exists, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product.

Recommendations For versions prior to 6.6.182, update to version 6.6.182 or later. For versions prior to 6.7.64, update to version 6.7.64 or later. For versions prior to 6.8.31, update to version 6.8.31 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-23941

Affected Products

Group-Office

References · 7

• https://osv.dev/vulnerability/CVE-2024-23941 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23941 · Security Note
• https://t.me/cvenotify/69544 · Telegram Post
• https://github.com/Intermesh/groupoffice · Note
• https://group-office.com · Note
• https://jvn.jp/en/jp/JVN63567545 · Note
• https://twitter.com/RedPacketSec/status/1753359013075394784 · Twitter Post