CVE-2024-33670

4.3 mediumEPSS 0.5%

Medium (4.3) in passbolt passbolt api. EPSS 0.5% chance of exploitation in the next 30 days.

Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript due to Content Security Policy (CSP) restrictions, it may still impact the appearance and user interaction of the page.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2024-04-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

passbolt:passbolt_api

References

https://help.passbolt.com/incidents/reflective-html-injection-vulnerability
https://www.passbolt.com/incidents
https://www.passbolt.com/security/more
https://help.passbolt.com/incidents/reflective-html-injection-vulnerability
https://www.passbolt.com/incidents

Check your stack JSON