Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-22418: Stored Cross-site Scripting Vulnerability via Malicious File Names in GroupOffice

CVE-2024-22418 · published 2 years ago

Summary

What to do

Update group-office group_office to version 6.8.29 or later.

Affected software

Vendor	Product	Affected versions
group-office	group_office	< 6.8.29 `cpe:2.3:a:group-office:group_office::::::::`

Original advisory text

Stored Cross-site Scripting Vulnerability via Malicious File Names in GroupOffice

Group-Office is an enterprise CRM and groupware tool. Affected versions are subject to a vulnerability which is present in the file upload mechanism of Group Office. It allows an attacker to execute arbitrary JavaScript code by embedding it within a file's name. For instance, using a filename such as “><img src=x onerror=prompt('XSS')>.jpg” triggers the vulnerability. When this file is uploaded, the JavaScript code within the filename is executed. This issue has been addressed in version 6.8.29. All users are advised to upgrade. There are no known workarounds for this vulnerability.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22418... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-22418 Vendor Advisory
https://github.com/Intermesh/groupoffice/security/advisories/GHSA-p7w9-h6c3-wqpp Vendor Advisory
https://github.com/Intermesh/groupoffice/commit/2a52a5d42d080db6738d70eba30294bc... Patch

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published18 Jan 2024

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2024-22418 · NVD

CVE-2024-22418 · OSV

GHSA-p7w9-h6c3-wqpp · GHSA

Track software like this

Free during beta