CVE-2024-7269 Stored XSS in ConnX ESP HR Management
Attackers can inject malicious scripts into the personal details form, potentially compromising user sessions in ConnX ESP HR Management.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-7269?
CVE-2024-7269 is a high-severity cross-site scripting vulnerability in ConnX ESP HR Management, published on 28 Aug 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Improper Neutralization of Input During Web Page Generation vulnerability in "Update of Personal Details" form in ConnX ESP HR Management allows Stored XSS attack. An attacker might inject a script to be run in user's browser. After multiple attempts to contact the vendor we did not receive any answer. The finder provided the information that this issue affects ESP HR Management versions before 6.6.
Weakness: CWE-79
Which versions are affected by CVE-2024-7269?
It affects 1 product.
Products include Connx Esp Hr Management.
How do I fix CVE-2024-7269?
No fix has been published for CVE-2024-7269 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-7269 being exploited?
There is no known exploitation of CVE-2024-7269 in the wild and no public exploit code.
Other vulnerabilities in ConnX ESP HR Management
Sources
Also known as GHSA-x928-8f88-6fjf.