PT-2024-40469 · Passbolt · Passbolt

Published 2024-05-20 · Updated 2024-05-20

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Passbolt (affected versions not specified)

Description The issue concerns the handling of user-specified input in emails sent by Passbolt, which may contain HTML code. An authenticated attacker could inject HTML code, such as an img tag, into a password description to potentially obtain information about another user's mail user-agent. The impact of this issue is considered very low, as most mail user-agents do not embed remote images to protect user privacy.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-V86M-J5F7-CCWH

Affected Products

Passbolt

References · 5

• https://osv.dev/vulnerability/GHSA-v86m-j5f7-ccwh · Vendor Advisory
• https://github.com/passbolt/passbolt_api · Note
• https://github.com/passbolt/passbolt_api/commit/00f0ebe37d78815adee26d5e80cf2250fe878647 · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/passbolt/passbolt_api/2019-02-11-3.yaml · Note
• https://passbolt.com/incidents/20190211_multiple_vulnerabilities · Note