CVE-2024-48937

Summary

CVE-2024-48937 is a newly disclosed vulnerability affecting Znuny versions 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16. This issue permits Cross-Site Scripting (XSS) attacks. Malicious JavaScript code injected into the short description of the SLA field in Activity Dialogues can be executed by unsuspecting users, potentially leading to data theft or unauthorized system access. Attackers can leverage this vulnerability to steal user credentials or perform malicious actions on behalf of the affected user. Users are advised to upgrade to the latest version of Znuny to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.