CVE-2024-42831
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
A reflected cross-site scripting (XSS) vulnerability in Elaine's Realtime CRM Automation v6.18.17 allows attackers to execute arbitrary JavaScript code in the user's web browser by injecting a crafted payload into the dialog parameter at wrapper_dialog.php.
Risk Assessment
An attacker can hijack user sessions, steal sensitive data, or perform other malicious actions within the CRM application context, compromising the confidentiality and integrity of organizational data.
Recommendation
Immediately update the system to the latest version and apply input filtering and validation for the dialog parameter in wrapper_dialog.php.
Original NVD description (English source)
A reflected cross-site scripting (XSS) vulnerability in Elaine's Realtime CRM Automation v6.18.17 allows attackers to execute arbitrary JavaScript code in the web browser of a user via injecting a crafted payload into the dialog parameter at wrapper_dialog.php.