PT-2024-27582 · Wofficeio · Office

Rafie Muhammad · Published 2024-07-04 · Updated 2026-01-09 · CVE-2024-37472

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Woffice versions through 5.4.8

Description The issue is a Cross Site Scripting (XSS) vulnerability, specifically a Reflected XSS, in WofficeIO Woffice. This type of vulnerability allows an attacker to inject malicious scripts into a website, potentially leading to unauthorized access or control.

Recommendations For versions through 5.4.8, consider disabling any features that may be susceptible to Reflected XSS attacks until a patch is available. Restrict access to potentially vulnerable modules or functions to minimize the risk of exploitation. Avoid using any parameters or variables that could be used to inject malicious scripts in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-37472

Affected Products

Office

References · 12

• https://osv.dev/vulnerability/CVE-2024-37472 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37472 · Security Note
• https://t.me/cvenotify/86780 · Telegram Post
• https://t.me/cvenotify/85183 · Telegram Post
• https://twitter.com/CVEnew/status/1808941911324930258 · Twitter Post
• https://patchstack.com/database/Wordpress/Theme/woffice/vulnerability/wordpress-woffice-theme-5-4-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/cracbot/status/1810192182290374921 · Twitter Post
• https://t.me/cveNotify/148167 · Telegram Post
• https://t.me/cvedetector/67 · Telegram Post
• https://twitter.com/cracbot/status/1810554537750782174 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1808964628296171712 · Twitter Post
• https://patchstack.com/database/vulnerability/woffice/wordpress-woffice-theme-5-4-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note