Vulnerability Description
StrangeBee TheHive 5.1.0 to 5.1.9 and 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case attachment functionality which enables an attacker to upload a malicious HTML file with Javascript code that will be executed in the context of the The Hive application using a specific URL. The vulnerability can be used to coerce a victim account to perform specific actions on the application as helping an analyst becoming administrator.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Strangebee | Thehive | >= 5.1.0, <= 5.1.9 |
Related Weaknesses (CWE)
References
- https://github.com/StrangeBeeCorp/Security/blob/main/Security%20advisories/SB-SEThird Party Advisory
- https://github.com/StrangeBeeCorp/Security/blob/main/Security%20advisories/SB-SEThird Party Advisory
FAQ
What is CVE-2024-22876?
CVE-2024-22876 is a vulnerability with a CVSS score of 5.4 (MEDIUM). StrangeBee TheHive 5.1.0 to 5.1.9 and 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case attachment functionality which enables an attacker to upload a malicious HTML file with Jav...
How severe is CVE-2024-22876?
CVE-2024-22876 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-22876?
Check the references section above for vendor advisories and patch information. Affected products include: Strangebee Thehive.