PT-2024-38221 · Unknown · Connx Esp Hr Management

Mariusz Sepczuk · Published 2024-08-28 · Updated 2025-01-08 · CVE-2024-7269

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ConnX ESP HR Management versions prior to 6.6

Description The issue is related to an Improper Neutralization of Input During Web Page Generation vulnerability in the "Update of Personal Details" form, allowing a Stored XSS attack. An attacker might inject a script to be run in a user's browser. Despite multiple attempts to contact the vendor, no response was received.

Recommendations For versions prior to 6.6, consider disabling the "Update of Personal Details" form until a patch is available to prevent potential Stored XSS attacks. Restrict access to this form to minimize the risk of exploitation. Avoid using this form until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-7269

Affected Products

Connx Esp Hr Management

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2024-7269 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7269 · Vendor Advisory
• https://t.me/cvenotify/95257 · Telegram Post
• https://cert.pl/en/posts/2024/08/CVE-2024-7269 · Note
• https://twitter.com/CVEnew/status/1828747182847254534 · Twitter Post
• https://t.me/latest_high_impact_cve/1072 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1828771366008418322 · Twitter Post
• https://twitter.com/CveFindCom/status/1828749619003543594 · Twitter Post
• https://t.me/cvenotify/92468 · Telegram Post
• https://connx.com.au · Note
• https://t.me/cvedetector/4322 · Telegram Post
• https://cert.pl/posts/2024/08/CVE-2024-7269 · Note
• https://reddit.com/r/CyberAlertFR/comments/1hwidrf/cisa_identifie_des_failles_critiques_dans_les · Reddit Post