CVE-2024-25344

    Dashboard / Vulnerabilities / CVE-2024-25344

    CVE-2024-25344

    Published: 26 Feb 2024Last Modified: 12 Aug 2026

    Summary:

    Details: Cross Site Scripting vulnerability in ITFlow.org before commit v.432488eca3998c5be6b6b9e8f8ba01f54bc12378 allows a remtoe attacker to execute arbitrary code and obtain sensitive information via the settings.php, settings+company.php, settings_defaults.php,settings_integrations.php, settings_invoice.php, settings_localization.php, settings_mail.php components.

    References: https://itflow.org/, https://packetstormsecurity.com/files/177224/ITFlow-Cross-Site-Request-Forgery.html, https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25344.json, https://nvd.nist.gov/vuln/detail/CVE-2024-25344, https://github.com/itflow-org/itflow/commit/432488eca3998c5be6b6b9e8f8ba01f54bc12378, https://github.com/itflow-org/itflow/commit/8068cb6081e4760860a634c1066b2c64d0ee2d46

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -34397fe4681dbf988ccfc5895bf4cd0986e2ae65

    Affected versions

    v25.02.4
    v25.02.3
    v25.02.1
    v25.02
    v25.02.2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-25344 | CVE-DB