medium6.3
CVE-2024-22220
An issue was discovered in Terminalfour 7.4 through 7.4.0004 QP3 and 8 through 8.3.19, and Formbank through 2.1.10-FINAL.
Impact
An issue was discovered in Terminalfour 7.4 through 7.4.0004 QP3 and 8 through 8.3.19, and Formbank through 2.1.10-FINAL. Unauthenticated Stored Cross-Site Scripting can occur, with resultant Admin Session Hijacking. The attack vectors are Form Builder and Form Preview.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Terminalfour | Formbank | through 2.1.10 |
| Terminalfour | Terminalfour | from 7.4 before 7.4.0004 from 8.0.0 through 8.3.19 Version 7.4.0004 |
Weakness classification
References
- NVD record
- CVE.org record
- https://docs.terminalfour.com/articles/release-notes-highlights/
- https://docs.terminalfour.com/release-notes/security-notices/cve-2024-22220/
- https://docs.terminalfour.com/articles/release-notes-highlights/
- https://docs.terminalfour.com/release-notes/security-notices/cve-2024-22220/