What’s Vulnerable › Vulnerabilities

CVE-2024-33670

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-04-26 · updated 2026-06-17
• Weakness: CWE-79

Description

Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript due to Content Security Policy (CSP) restrictions, it may still impact the appearance and user interaction of the page.

Affected products

• Passbolt API: before 4.6.2 — fixed in 4.6.2

How to fix

Upgrade to a fixed version: Passbolt API 4.6.2. Check the vendor advisory for mitigations.

References

• https://help.passbolt.com/incidents/reflective-html-injection-vulnerability
• https://www.passbolt.com/incidents
• https://www.passbolt.com/security/more
• https://help.passbolt.com/incidents/reflective-html-injection-vulnerability
• https://www.passbolt.com/incidents
• https://www.passbolt.com/security/more

Get alerted when CVE-2024-33670 or the next vulnerability affects your stack