CVE-2024-33326

MEDIUMNuclei

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2024-33326 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

A cross-site scripting (XSS) vulnerability in the component XsltResultControllerHtml.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the lumPageID parameter.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Sep 25, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 9, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Lumisxp

Browse Lumis / Lumisxp
VulnCheckVersion data not supplied

lumis_experience_platform

Browse lumis / lumis_experience_platform

Default status: unknown

CVE List15.0.x to ≤ 16.1.xaffected

Nuclei templates

1
ProjectDiscoveryMEDIUMLumisXP - Cross-site ScriptingCVSS 5.4

A cross-site scripting (XSS) vulnerability in the XsltResultControllerHtml.jsp component of LumisXP v15.0.x to v16.1.x allows attackers to execute arbitrary web scripts or HTML via the lumPageID parameter.

Impact

Successful exploitation allows attackers to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, credential theft, or defacement.

Remediation

Apply security patches or upgrade to a version that addresses this XSS vulnerability. Implement proper input validation and output encoding.

WeaknessesCWE-79
Authors0xr2r
Template tagscvecve2024xsslumislumisxpvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CPE: cpe:2.3:a:lumis:lumis_experience_platform:*:*:*:*:*:*:*:*
https://gist.github.com/rodnt/51ae2897abfff1bdcedccf72edbf3d24 https://seclists.org/fulldisclosure/2024/Jul/10 https://nvd.nist.gov/vuln/detail/CVE-2024-33326

Source: ProjectDiscovery

References

3