CVE-2024-6892 - OpenCVE

Attackers can craft a malicious link that once clicked will execute arbitrary JavaScript in the context of the Journyx web application.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Journyx	Journyx

Configuration 1 [-]

cpe:2.3:a:journyx:journyx:11.5.4:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://seclists.org/fulldisclosure/2024/Aug/7
https://korelogic.com/Resources/Advisories/KL-001-2024-009.txt

History

Fri, 06 Sep 2024 17:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Journyx Journyx journyx
Weaknesses		CWE-79
CPEs		cpe:2.3:a:journyx:journyx:11.5.4:::::::*
Vendors & Products		Journyx Journyx journyx

Fri, 09 Aug 2024 17:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}`

Fri, 09 Aug 2024 16:15:00 +0000

Type	Values Removed	Values Added
References		http://seclists.org/fulldisclosure/2024/Aug/7

Wed, 07 Aug 2024 23:30:00 +0000

Type	Values Removed	Values Added
Description		Attackers can craft a malicious link that once clicked will execute arbitrary JavaScript in the context of the Journyx web application.
Title		Journyx Reflected Cross Site Scripting
Weaknesses		CWE-81
References		https://korelogic.com/Resources/Advisories/KL-001-2024-009.txt

MITRE

Status: PUBLISHED

Assigner: KoreLogic

Published: 2024-08-07T23:19:00.527Z

Updated: 2024-08-09T15:29:23.033Z

Reserved: 2024-07-18T19:25:50.756Z

Link: CVE-2024-6892

Vulnrichment

Updated: 2024-08-08T01:29:16.386Z

NVD

Status : Analyzed

Published: 2024-08-08T00:15:40.707

Modified: 2024-09-06T16:33:34.360

Link: CVE-2024-6892

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-6892", "assignerOrgId": "bbf0bd87-ece2-41be-b873-96928ee8fab9", "state": "PUBLISHED", "assignerShortName": "KoreLogic", "dateReserved": "2024-07-18T19:25:50.756Z", "datePublished": "2024-08-07T23:19:00.527Z", "dateUpdated": "2024-08-09T15:29:23.033Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "Journyx (jtime)", "vendor": "Journyx", "versions": [{"status": "affected", "version": "11.5.4"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Jaggar Henry of KoreLogic, Inc."}], "datePublic": "2024-08-07T23:16:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<pre>Attackers can craft a malicious link that once clicked will execute arbitrary JavaScript in the context of the Journyx web application.</pre><br>"}], "value": "Attackers can craft a malicious link that once clicked will execute arbitrary JavaScript in the context of the Journyx web application."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-81", "description": "CWE-81 Improper Neutralization of Script in an Error Message Web Page", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "bbf0bd87-ece2-41be-b873-96928ee8fab9", "shortName": "KoreLogic", "dateUpdated": "2024-08-07T23:19:00.527Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://korelogic.com/Resources/Advisories/KL-001-2024-009.txt"}], "source": {"discovery": "UNKNOWN"}, "title": "Journyx Reflected Cross Site Scripting", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://seclists.org/fulldisclosure/2024/Aug/7"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-08T01:29:16.386Z"}}, {"affected": [{"vendor": "journyx", "product": "journyx", "cpes": ["cpe:2.3:a:journyx:journyx:11.5.4:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "11.5.4", "status": "affected"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-08-09T15:28:34.870190Z", "id": "CVE-2024-6892", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-09T15:29:23.033Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://seclists.org/fulldisclosure/2024/Aug/7"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-08T01:29:16.386Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-6892", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-09T15:28:34.870190Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:journyx:journyx:11.5.4:*:*:*:*:*:*:*"], "vendor": "journyx", "product": "journyx", "versions": [{"status": "affected", "version": "11.5.4"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-09T15:29:17.846Z"}}], "cna": {"title": "Journyx Reflected Cross Site Scripting", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Jaggar Henry of KoreLogic, Inc."}], "affected": [{"vendor": "Journyx", "product": "Journyx (jtime)", "versions": [{"status": "affected", "version": "11.5.4"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}], "datePublic": "2024-08-07T23:16:00.000Z", "references": [{"url": "https://korelogic.com/Resources/Advisories/KL-001-2024-009.txt", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Attackers can craft a malicious link that once clicked will execute arbitrary JavaScript in the context of the Journyx web application.", "supportingMedia": [{"type": "text/html", "value": "<pre>Attackers can craft a malicious link that once clicked will execute arbitrary JavaScript in the context of the Journyx web application.</pre><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-81", "description": "CWE-81 Improper Neutralization of Script in an Error Message Web Page"}]}], "providerMetadata": {"orgId": "bbf0bd87-ece2-41be-b873-96928ee8fab9", "shortName": "KoreLogic", "dateUpdated": "2024-08-07T23:19:00.527Z"}}}, "cveMetadata": {"cveId": "CVE-2024-6892", "state": "PUBLISHED", "dateUpdated": "2024-08-09T15:29:23.033Z", "dateReserved": "2024-07-18T19:25:50.756Z", "assignerOrgId": "bbf0bd87-ece2-41be-b873-96928ee8fab9", "datePublished": "2024-08-07T23:19:00.527Z", "assignerShortName": "KoreLogic"}, "dataVersion": "5.1"}