CVE-2024-22220

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-21 · updated 2026-06-17
Weakness: CWE-79

Description

An issue was discovered in Terminalfour 7.4 through 7.4.0004 QP3 and 8 through 8.3.19, and Formbank through 2.1.10-FINAL. Unauthenticated Stored Cross-Site Scripting can occur, with resultant Admin Session Hijacking. The attack vectors are Form Builder and Form Preview.

Affected products

Terminalfour Formbank: through 2.1.10
Terminalfour: from 7.4 before 7.4.0004; from 8.0.0 through 8.3.19; 7.4.0004-qp2, 7.4.0004-qp3 — fixed in 7.4.0004

How to fix

Upgrade to a fixed version: Terminalfour 7.4.0004. Check the vendor advisory for mitigations.

References

https://docs.terminalfour.com/articles/release-notes-highlights/
https://docs.terminalfour.com/release-notes/security-notices/cve-2024-22220/
https://docs.terminalfour.com/articles/release-notes-highlights/
https://docs.terminalfour.com/release-notes/security-notices/cve-2024-22220/

Get alerted when CVE-2024-22220 or the next vulnerability affects your stack