Cross Site Scripting Vulnerability in Sage DPW Software
CVE-2024-56882

5.4MEDIUM

Key Information:

Vendor

Sage

Status
Sage DPW
Vendor
CVE Published:
18 February 2025

What is CVE-2024-56882?

Sage DPW prior to version 2024_12_000 is susceptible to a Cross Site Scripting (XSS) vulnerability. This flaw enables low-privileged users with employee role access to embed malicious JavaScript code into the Kurstitel and Kurzinfo input fields. When other authenticated users access the compromised data, the injected scripts are executed in their browsers, potentially leading to unauthorized actions and data exposure.

References

https://cves.at/posts/cve-cve-2024-56882/writeup/

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.