VulnerabilityDeferred

CVE-2024-11479

A HTML Injection vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user.

MEDIUM 5.1EPSS 0.39%

Does this matter?

Lower severity and a low EPSS score (0.39%). Track it; it rarely justifies an emergency change on its own.

Description

A HTML Injection vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user. HTML markup could be added to comments of tickets, which when submitted will render in the emails sent to all users on that ticket.

CVSS 4.0: 5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.39% probability · 33th percentile
CISA KEV: Not listed
Weakness: CWE-79, CWE-80
Source: b7efe717-a805-47cf-8e9a-921fca0ce0ce

References

https://helpcenter.issuetrak.com/home/2340-issuetrak-release-notes

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.