Cross-Site Scripting Vulnerability in Group Office Software
CVE-2024-23941

5.4MEDIUM

Key Information:

Vendor

Intermesh Bv

Status
Group Office
Vendor
CVE Published:
1 February 2024

What is CVE-2024-23941?

A cross-site scripting vulnerability exists in Group Office that could allow a remote authenticated attacker to execute arbitrary scripts within the web browser session of users logging into the application. This can lead to unauthorized actions being performed on behalf of users, sensitive data exposure, and other security breaches.

Affected Version(s)

Group Office prior to v6.6.182

Group Office prior to v6.7.64

Group Office prior to v6.8.31

References

https://github.com/Intermesh/groupoffice/
https://www.group-office.com/
https://jvn.jp/en/jp/JVN63567545/

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.