Cross-Site Scripting Vulnerability in Ortto Web Application
CVE-2024-52482

7.1HIGH

Key Information:

Vendor

WordPress
Status
Ortto
Vendor
CVE Published:
2 December 2024

What is CVE-2024-52482?

A critical Cross-Site Scripting (XSS) vulnerability exists within the Ortto web application, allowing attackers to inject potentially harmful scripts into web pages viewed by users. This reflected XSS flaw poses significant security risks, including unauthorized access to sensitive user data. The vulnerability affects all versions of the Ortto application up to 1.0.19, enabling exploitation that could lead to compromised account credentials and session hijacking. It is crucial for users of the affected versions to apply patches and follow best security practices to mitigate the risks associated with this vulnerability.

Affected Version(s)

Ortto 0 <= 1.0.19

References

https://patchstack.com/database/Wordpress/Plugin/autopilo...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Le Ngoc Anh (Patchstack Alliance)
.