Stored XSS Vulnerability
CVE-2024-6881

8.5HIGH

Key Information:

Vendor

M-files Corporation

Status
Hubshare
Vendor
CVE Published:
29 July 2024

What is CVE-2024-6881?

A stored cross-site scripting (XSS) vulnerability exists in M-Files Hubshare versions prior to 5.0.6.0. This issue allows authenticated attackers to inject and execute arbitrary JavaScript code within users' browser sessions, potentially compromising sensitive information or enabling unauthorized actions while users interact with the application.

Affected Version(s)

Hubshare 0 < 5.0.6.0

References

https://product.m-files.com/security-advisories/cve-2024-...
vendor-advisory
https://empower.m-files.com/security-advisories/CVE-2024-...
vendor-advisory

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

Credit

Markus Tirrenberg / WithSecure
Emma Kantanen / WithSecure
.