CyberRota Analysis
This is a medium severity vulnerability with a CVSS score of 6.1. Exploitation may require the attacker to be authenticated.
CVE
CVE-2024-12020
Severity
MEDIUM
CVSS
6.1
EPSS
0.24%
Original NVD Description
There is a reflected cross-site scripting (XSS) within JSP files used to control application appearance. An unauthenticated attacker could deceive a user into clicking a crafted link to trigger the vulnerability. Stealing the session cookie is not possible due to cookie security flags, however the XSS may be used to induce a victim to perform on-site requests without their knowledge. This vulnerability only affects LogicalDOC Enterprise.
Related CVEs
Other vulnerabilities affecting the same vendor(s)