CVE-2024-49337: IBM OpenPages HTML injection
IBM OpenPages is vulnerable to HTML injection, caused by improper validation of user-supplied input of text fields used to construct workflow email notifications. A remote authenticated attacker could exploit this vulnerability using HTML tags in a text field of an object to inject malicious script into an email which would be executed in a victim's mail client within the security context of the OpenPages mail message. An attacker could use this for phishing or identity theft attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49337?
CVE-2024-49337 is rated as a moderate severity vulnerability due to the potential for HTML injection.
How do I fix CVE-2024-49337?
To fix CVE-2024-49337, apply the patch available in IBM OpenPages 9.0 Fix Pack 4.
Which versions of IBM OpenPages are affected by CVE-2024-49337?
CVE-2024-49337 affects IBM OpenPages versions up to and including 9.0 and IBM OpenPages with Watson up to and including version 8.3.
Can CVE-2024-49337 be exploited remotely?
Yes, CVE-2024-49337 can be exploited remotely by an authenticated attacker through user-supplied input.
What type of attack does CVE-2024-49337 facilitate?
CVE-2024-49337 facilitates HTML injection attacks through improper validation of input fields.