CVE-2024-46073

A reflected Cross-Site Scripting (XSS) vulnerability exists in the login page of IceHRM v32.4.0.OS. The vulnerability is due to improper sanitization of the "next" parameter, which is included in the application's response without adequate escaping. An attacker can exploit this flaw by tricking a user into visiting a specially crafted URL, causing the execution of arbitrary JavaScript code in the context of the victim's browser. The issue occurs even though the application has sanitization mechanisms in place.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/gamonoid/icehrm
https://github.com/manisashank/CVE-Publish/blob/main/CVE-2024-46073.md

Configurations

No configuration.

History

No history.

Information

Published : 2025-01-06 18:15

Updated : 2026-06-17 07:55

NVD link : CVE-2024-46073

Mitre link : CVE-2024-46073

CVE.ORG link : CVE-2024-46073

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-46073", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-46073", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-06T20:04:15.745365Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-01-06T18:15:19.493", "references": [{"url": "https://github.com/gamonoid/icehrm", "source": "cve@mitre.org"}, {"url": "https://github.com/manisashank/CVE-Publish/blob/main/CVE-2024-46073.md", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A reflected Cross-Site Scripting (XSS) vulnerability exists in the login page of IceHRM v32.4.0.OS. The vulnerability is due to improper sanitization of the \"next\" parameter, which is included in the application's response without adequate escaping. An attacker can exploit this flaw by tricking a user into visiting a specially crafted URL, causing the execution of arbitrary JavaScript code in the context of the victim's browser. The issue occurs even though the application has sanitization mechanisms in place."}, {"lang": "es", "value": "Existe una vulnerabilidad de tipo Cross-Site Scripting (XSS) reflejado en la p\u00e1gina de inicio de sesi\u00f3n de IceHRM v32.4.0.OS. La vulnerabilidad se debe a una desinfecci\u00f3n incorrecta del par\u00e1metro \"next\", que se incluye en la respuesta de la aplicaci\u00f3n sin el escape adecuado. Un atacante puede aprovechar esta falla enga\u00f1ando a un usuario para que visite una URL especialmente manipulada, lo que provoca la ejecuci\u00f3n de c\u00f3digo JavaScript arbitrario en el contexto del navegador de la v\u00edctima. El problema ocurre a pesar de que la aplicaci\u00f3n tiene mecanismos de desinfecci\u00f3n implementados."}], "lastModified": "2026-06-17T07:55:09.063", "sourceIdentifier": "cve@mitre.org"}