PT-2025-18713 · Sematell · Sematell Replyone

Published 2025-05-01 · Updated 2025-05-03 · CVE-2024-48906

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sematell ReplyOne version 7.4.3.0

Description The issue allows for cross-site scripting (XSS) attacks through a ReplyDesk e-mail attachment name. This means an attacker could potentially inject malicious scripts into the system by manipulating the name of an attachment in an email, leading to the execution of unwanted actions on the user's browser.

Recommendations For Sematell ReplyOne version 7.4.3.0, consider validating and sanitizing all user-input data, including email attachment names, to prevent XSS attacks. As a temporary workaround, restrict the ability to upload or send emails with attachments until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-48906

Affected Products

Sematell Replyone

References · 6

• 🔥 https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-081.txt · Exploit
• https://osv.dev/vulnerability/CVE-2024-48906 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-48906 · Security Note
• https://t.me/cvedetector/24286 · Telegram Post
• https://twitter.com/CVEnew/status/1918568541789536354 · Twitter Post
• https://t.me/cvetracker/22873 · Telegram Post