ByteOS Network

NVD Vulnerability Details :

CVE-2024-33670

Analyzed

Source-cve@mitre.org

Published At-26 Apr, 2024 | 01:15

Updated At-18 Jun, 2025 | 19:16

Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript due to Content Security Policy (CSP) restrictions, it may still impact the appearance and user interaction of the page.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Type: Secondary

Version: 3.1

Base score: 4.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

CPE Matches

passbolt>>passbolt_api>>Versions before 4.6.2(exclusive)

cpe:2.3:a:passbolt:passbolt_api:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-79

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
https://help.passbolt.com/incidents/reflective-html-injection-vulnerability	cve@mitre.org	Issue Tracking Vendor Advisory
https://www.passbolt.com/incidents	cve@mitre.org	Issue Tracking Vendor Advisory
https://www.passbolt.com/security/more	cve@mitre.org	Product
https://help.passbolt.com/incidents/reflective-html-injection-vulnerability	af854a3a-2127-422b-91ae-364da2661108	Issue Tracking Vendor Advisory
https://www.passbolt.com/incidents	af854a3a-2127-422b-91ae-364da2661108	Issue Tracking Vendor Advisory
https://www.passbolt.com/security/more	af854a3a-2127-422b-91ae-364da2661108	Product