Vulnerability · Published Jun 14, 2024 · Assigned by CERT-PL

CVE-2024-5961Reflected XSS in 2ClickPortal

Medium 5.3

In plain English

A medium-severity cross-site scripting in 2ClickPortal from Trol InterMedia Sp. z o.o. Sp. k.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)1.3%top 29.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Improper neutralization of input during web page generation vulnerability in 2ClickPortal software allows reflected cross-site scripting (XSS). An attacker might trick somebody into using a crafted URL, which will cause a script to be run in user's browser. This issue affects 2ClickPortal software versions from 7.2.31 through 7.6.4.

Affected products (as reported)

Vendor	Product	Versions
Trol InterMedia Sp. z o.o. Sp. k.	2ClickPortal	7.2.31 – through 7.6.4

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/AU:Y/R:A/U:Clear

References

https://cert.pl/en/posts/2024/06/CVE-2024-5961/ third-party-advisory
https://cert.pl/posts/2024/06/CVE-2024-5961/ third-party-advisory
https://2clickportal.pl/ product