CVE-2024-33326
Published: 26 June 2024
Summary
CVE-2024-33326 is a medium-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 6.1 (Medium).
Operationally, ranked in the top 9.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A cross-site scripting vulnerability tracked as CVE-2024-33326 affects the XsltResultControllerHtml.jsp component in Lumisxp versions 15.0.x through 16.1.x. The flaw is triggered when attacker-supplied input reaches the lumPageID parameter, allowing arbitrary script or HTML execution. It carries a CVSS 3.1 base score of 6.1 and is classified under CWE-79.
An unauthenticated remote attacker can exploit the issue by crafting a malicious link or request containing the payload. Successful exploitation requires a victim user to interact with the link, after which the attacker can execute scripts in the context of the vulnerable application, potentially leading to limited confidentiality and integrity impacts within the affected site.
The EPSS score for this CVE rose from a low baseline to a recorded peak of 0.0970 with a current value of 0.0605, indicating emerging exploitation interest after public disclosure. Public references consist of a Full Disclosure mailing-list post and an accompanying proof-of-concept gist, though no vendor patch or mitigation guidance is detailed in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-31068
Vulnerability details
A cross-site scripting (XSS) vulnerability in the component XsltResultControllerHtml.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the lumPageID parameter.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.