CVE-2024-22220

An issue was discovered in Terminalfour 7.4 through 7.4.0004 QP3 and 8 through 8.3.19, and Formbank through 2.1.10-FINAL. Unauthenticated Stored Cross-Site Scripting can occur, with resultant Admin Session Hijacking. The attack vectors are Form Builder and Form Preview.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
mitreCNA
---
---
CISA-ADPADP
6.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 43%
VendorProductVersion
terminalfourformbank
𝑥
≤ 2.1.10
terminalfourterminalfour
7.4 ≤
𝑥
< 7.4.0004
terminalfourterminalfour
8.0.0 ≤
𝑥
≤ 8.3.19
terminalfourterminalfour
7.4.0004:qp2
terminalfourterminalfour
7.4.0004:qp3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://docs.terminalfour.com/articles/release-notes-highlights/
https://docs.terminalfour.com/release-notes/security-notices/cve-2024-22220/
https://docs.terminalfour.com/articles/release-notes-highlights/
https://docs.terminalfour.com/release-notes/security-notices/cve-2024-22220/