Intermesh Group Office up to 6.6.181/6.7.63/6.8.30 cross site scripting

Summaryinfo

A vulnerability classified as problematic was found in Intermesh Group Office up to 6.6.181/6.7.63/6.8.30. Impacted is an unknown function. Executing a manipulation can lead to cross site scripting. This vulnerability is tracked as CVE-2024-23941. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic was found in Intermesh Group Office up to 6.6.181/6.7.63/6.8.30. This vulnerability affects an unknown function. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. CVE summarizes:

Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product.

The weakness was disclosed 02/01/2024. The advisory is shared for download at github.com. This vulnerability was named CVE-2024-23941 since 01/24/2024. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1059.007.

Upgrading to version 6.6.182, 6.7.64 or 6.8.31 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2024-21371). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Intermesh

Name

• Group Office

Version

• 6.6.181
• 6.7.0
• 6.7.1
• 6.7.2
• 6.7.3
• 6.7.4
• 6.7.5
• 6.7.6
• 6.7.7
• 6.7.8
• 6.7.9
• 6.7.10
• 6.7.11
• 6.7.12
• 6.7.13
• 6.7.14
• 6.7.15
• 6.7.16
• 6.7.17
• 6.7.18
• 6.7.19
• 6.7.20
• 6.7.21
• 6.7.22
• 6.7.23
• 6.7.24
• 6.7.25
• 6.7.26
• 6.7.27
• 6.7.28
• 6.7.29
• 6.7.30
• 6.7.31
• 6.7.32
• 6.7.33
• 6.7.34
• 6.7.35
• 6.7.36
• 6.7.37
• 6.7.38
• 6.7.39
• 6.7.40
• 6.7.41
• 6.7.42
• 6.7.43
• 6.7.44
• 6.7.45
• 6.7.46
• 6.7.47
• 6.7.48
• 6.7.49
• 6.7.50
• 6.7.51
• 6.7.52
• 6.7.53
• 6.7.54
• 6.7.55
• 6.7.56
• 6.7.57
• 6.7.58
• 6.7.59
• 6.7.60
• 6.7.61
• 6.7.62
• 6.7.63
• 6.8.0
• 6.8.1
• 6.8.2
• 6.8.3
• 6.8.4
• 6.8.5
• 6.8.6
• 6.8.7
• 6.8.8
• 6.8.9
• 6.8.10
• 6.8.11
• 6.8.12
• 6.8.13
• 6.8.14
• 6.8.15
• 6.8.16
• 6.8.17
• 6.8.18
• 6.8.19
• 6.8.20
• 6.8.21
• 6.8.22
• 6.8.23
• 6.8.24
• 6.8.25
• 6.8.26
• 6.8.27
• 6.8.28
• 6.8.29
• 6.8.30

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion