CVE-2024-7269
Medium
Description
Improper Neutralization of Input During Web Page Generation vulnerability in "Update of Personal Details" form in ConnX ESP HR Management allows Stored XSS attack. An attacker might inject a script to be run in user's browser. After multiple attempts to contact the vendor we did not receive any answer. The finder provided the information that this issue affects ESP HR Management versions before 6.6.
SeverityMedium
CVSS5.4
Exploit probability—
ProductConnx Esp Hr Management
PublishedAug 28, 2024
First seenAug 28, 2024
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- connx esp_hr_management6.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| connx esp_hr_management | v < 6.6 | 6.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.