1. Home
  2. CVE Database
  3. CVE-2024-56882
MEDIUM · 5.4

CVE-2024-56882

Sage DPW before 2024_12_000 is vulnerable to Cross Site Scripting (XSS). Low-privileged Sage users with employee role privileges can permanently store JavaScript code in the Kurstitel and Kurzinfo inp...

Vulnerability Description

Sage DPW before 2024_12_000 is vulnerable to Cross Site Scripting (XSS). Low-privileged Sage users with employee role privileges can permanently store JavaScript code in the Kurstitel and Kurzinfo input fields. The injected payload is executed for each authenticated user who views and interacts with the modified data elements.

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
SagedpwSage Dpw< 2024_12_000

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2024-56882?

CVE-2024-56882 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Sage DPW before 2024_12_000 is vulnerable to Cross Site Scripting (XSS). Low-privileged Sage users with employee role privileges can permanently store JavaScript code in the Kurstitel and Kurzinfo inp...

How severe is CVE-2024-56882?

CVE-2024-56882 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-56882?

Check the references section above for vendor advisories and patch information. Affected products include: Sagedpw Sage Dpw.