« Volver al listado

CVE-2024-23941

Estado: ModificadaMedia (5.4)—

Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Group-office — Group Office

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-23941",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-23941",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-02-05T18:46:18.532239Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "Intermesh BV",
          "product": "Group Office",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v6.6.182"
            }
          ]
        },
        {
          "vendor": "Intermesh BV",
          "product": "Group Office",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v6.7.64"
            }
          ]
        },
        {
          "vendor": "Intermesh BV",
          "product": "Group Office",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v6.8.31"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-02-01T04:15:49.967",
  "references": [
    {
      "url": "https://github.com/Intermesh/groupoffice/",
      "tags": [
        "Product"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN63567545/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.group-office.com/",
      "tags": [
        "Product"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://github.com/Intermesh/groupoffice/",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN63567545/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.group-office.com/",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de cross site scripting en Group Office antes de v6.6.182, antes de v6.7.64 y antes de v6.8.31, lo que puede permitir que un atacante remoto autenticado ejecute un script arbitrario en el navegador web del usuario que inicia sesión en el producto."
    }
  ],
  "lastModified": "2026-06-17T07:13:55.407",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:group-office:group_office:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E57242BD-9BF6-4B67-9583-60F0C357DCFD",
              "versionEndExcluding": "6.6.182"
            },
            {
              "criteria": "cpe:2.3:a:group-office:group_office:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BE1C3FEA-5399-43E7-B467-0C32FBEBF7F3",
              "versionEndExcluding": "6.7.64",
              "versionStartIncluding": "6.7.0"
            },
            {
              "criteria": "cpe:2.3:a:group-office:group_office:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8E8C282E-9E5B-478A-80B2-A3A86ED67495",
              "versionEndExcluding": "6.8.31",
              "versionStartIncluding": "6.8.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}