CVE-2024-48937

MEDIUM

Znuny 6.0.0-6.0.10 and 7.0.1-7.0.16 - Stored Cross-Site Scripting in SLA Field Short Description

Title source: llm
STIX 2.1

Description

Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows XSS. JavaScript code in the short description of the SLA field in Activity Dialogues is executed.

References (3)

Core 3

Scores

CVSS v3 6.1
EPSS 0.0037
EPSS Percentile 28.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
znuny/znuny 6.0.0 - 6.1.0
znuny/znuny 7.0.1 - 7.0.16
Published Oct 11, 2024
Tracked Since Feb 18, 2026