Threat Investigation
Request a demo

CVE-2024-28734

Medium

Description

Cross Site Scripting vulnerability in Unit4 Financials by Coda prior to 2023Q4 allows a remote attacker to run arbitrary code via a crafted GET request using the cols parameter.

SeverityMedium
CVSS6.1
Exploit probability—
ProductUnit4 Financials
PublishedMar 19, 2024
First seenMar 19, 2024
Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update
  • unit4 financials2023Q4 or later

Affected products

ProductAffected versionsFixed in
unit4 financialsv < 2023Q42023Q4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.