CVE-2024-6892

Deeper analysis

CVE-2024-6892 is a reflected cross-site scripting vulnerability (CWE-79, CWE-81) in the Journyx web application. Attackers can supply a crafted URL that causes the application to echo attacker-controlled JavaScript back to a victim browser, executing it in the context of the Journyx origin. The flaw carries a CVSS 3.1 score of 6.1 with network attack vector, low complexity, no required privileges, and required user interaction.

An unauthenticated attacker can create a malicious link and deliver it to a Journyx user via email, chat, or another channel. When the recipient clicks the link, arbitrary JavaScript runs inside the Journyx session, enabling actions such as reading or modifying limited application data visible to that user. The reflected nature of the flaw means exploitation succeeds only on direct interaction with the supplied link.

Public advisories from KoreLogic and the Full Disclosure mailing list describe the issue and are available at the referenced URLs; they do not detail vendor patches or configuration work-arounds in the supplied references. The associated EPSS score has remained flat at 0.0751 with no observed rise after disclosure.