CVE-2024-33670
CVE-2024-33670
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript due to Content Security Policy (CSP) restrictions, it may still impact the appearance and user interaction of the page.
CVSS 4.3 · Medium · EPSS 0.5% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
passbolt/passbolt_api Packagist
- Versions
- v1.0.10
- v1.0.11
- v1.0.12
- v1.0.13
- v1.0.14
- v1.0.5
- v1.0.6
- v1.0.7
- v1.0.8
- v1.0.9
- v1.1.0
- v1.2.0
- v1.2.1
- v1.3.0
- v1.3.1
- v1.3.2
- v1.4.0
- v1.5.1
- v1.6.0
- v1.6.1
- v1.6.10
- v1.6.2
- v1.6.3
- v1.6.4
- v1.6.5
- v1.6.9
- v2.0.0
- v2.0.0-rc1
- v2.0.0-rc2
- v2.0.1
- v2.0.2
- v2.0.3
- v2.0.4
- v2.0.5
- v2.0.7
- v2.0.8
- v2.1.0
- v2.1.1
- v2.10.0
- v2.11.0
- v2.12.0
- v2.12.1
- v2.13.0
- v2.13.0-RC1
- v2.13.1
- v2.13.5
- v2.14.0
- v2.2.0
- v2.3.0
- v2.4
- v2.5.0
- v2.5.1
- v2.6.0
- v2.6.1
- v2.7.0
- v2.7.1
- v2.7.2
- v2.8.0
- v2.8.1
- v2.8.2
- v2.8.3
- v2.8.4
- v2.8.5
- v2.9.0
- v3.0.0
- v3.0.1
- v3.0.2
- v3.1.0
- v3.10.0
- v3.11.0
- v3.11.1
- v3.12.0
- v3.12.0-rc.1
- v3.12.0-rc.2
- v3.12.2
- v3.12.2-rc.1
- v3.12.2-rc.5
- v3.2.0
- v3.2.1
- v3.2.2
- v3.3.0
- v3.3.1
- v3.4.0
- v3.5.0
- v3.6.0
- v3.7.0
- v3.7.1
- v3.7.2
- v3.7.3
- v3.8.0
- v3.8.1
- v3.8.3
- v3.9.0
- v4.0.0
- v4.0.0-rc.2
- v4.0.0-rc.3
- v4.0.0-rc.4
- v4.0.0-rc.5
- v4.0.1
- v4.0.1-rc.1
- v4.0.2
- v4.0.2-rc.1
- v4.1.0
- v4.1.0-rc.2
- v4.1.0-rc.3
- v4.1.1
- v4.1.1-rc.1
- v4.1.1-rc.2
- v4.1.2
- v4.1.2-rc.2
- v4.2.0
- v4.2.0-rc.1
- v4.2.0-rc.2
- v4.3.0
- v4.3.0-rc.1
- v4.4.0
- v4.4.0-rc.1
- v4.4.1
- v4.4.2
- v4.5.0
- v4.5.0-rc.1
- v4.5.2
- v4.6.0
- v4.6.0-rc.1
- v4.6.0-rc.2
- v4.6.1
- Affected ranges
- ECOSYSTEM: < 4.6.2
Update to 4.6.2