CVE-2024-5142
Assigner: M-Files Corporation
Published: 2024-05-24T05:58:41.316Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Hubshare
vendor: M-Files Corporation
versions: lessThan: 5.0.3.8
status: affected
version: 0
versionType: custom
datePublic: 2024-05-24T05:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">Stored Cross-Site Scripting vulnerability in Social Module in M-Files Hubshare before version 5.0.3.8 allows authenticated attacker to run scripts in other users browser</span>


value: Stored Cross-Site Scripting vulnerability in Social Module in M-Files Hubshare before version 5.0.3.8 allows authenticated attacker to run scripts in other users browser
impacts: capecId: CAPEC-592
descriptions: value: CAPEC-592 Stored XSS
metrics: cvssV4_0: Automatable: NOT_DEFINED
Recovery: NOT_DEFINED
Safety: NOT_DEFINED
attackComplexity: LOW
attackRequirements: NONE
attackVector: NETWORK
baseScore: 7
baseSeverity: HIGH
privilegesRequired: LOW
providerUrgency: NOT_DEFINED
subAvailabilityImpact: NONE
subConfidentialityImpact: NONE
subIntegrityImpact: NONE
userInteraction: PASSIVE
valueDensity: NOT_DEFINED
vectorString: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
version: 4.0
vulnAvailabilityImpact: NONE
vulnConfidentialityImpact: HIGH
vulnIntegrityImpact: LOW
vulnerabilityResponseEffort: NOT_DEFINED
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: Update to patched version
value: Update to patched version
source: discovery: UNKNOWN
title: XSS in Hubshare's social module
x_generator: engine: Vulnogram 0.2.0