CVE-2024-33327

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-26 · updated 2026-06-17
Weakness: CWE-79

Description

A cross-site scripting (XSS) vulnerability in the component UrlAccessibilityEvaluation.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the contentHtml parameter.

Affected products

Lumis Experience Platform: from 15.0.x before 16.1.x — fixed in 16.1.x

How to fix

Upgrade to a fixed version: Lumis Experience Platform 16.1.x. Check the vendor advisory for mitigations.

References

http://seclists.org/fulldisclosure/2024/Jul/9
https://gist.github.com/rodnt/c53d4c95bb6966f0a2cf381ae5089c79
http://seclists.org/fulldisclosure/2024/Jul/9
https://gist.github.com/rodnt/c53d4c95bb6966f0a2cf381ae5089c79

Get alerted when CVE-2024-33327 or the next vulnerability affects your stack