{"id":"CVE-2024-23941","aliases":["EUVD-2024-21371","GHSA-5rhg-f75j-57f8"],"status":"published","title":"Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and...","description":"Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00618,"percentile":0.50059,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2024-02-01T03:56:12Z","modified":"2026-10-28T02:30:28Z","products":[{"vendor":"group-office","product":"group_office"},{"vendor":"intermesh bv","product":"group office"}],"references":[{"url":"https://github.com/Intermesh/groupoffice/","tags":["x_transferred","Product","web"]},{"url":"https://www.group-office.com/","tags":["x_transferred","Product","web"]},{"url":"https://jvn.jp/en/jp/JVN63567545/","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23941","tags":["advisory"]},{"url":"https://github.com/Intermesh/groupoffice"},{"url":"https://jvn.jp/en/jp/JVN63567545"},{"url":"https://www.group-office.com"},{"url":"https://github.com/advisories/GHSA-5rhg-f75j-57f8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23941.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-23941","description":"Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product.","status":"published","published":"2024-02-01T03:56:12.231Z","modified":"2025-06-04T15:25:00.832Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:05.077718Z"}],"euvd":[{"id":"EUVD-2024-21371","description":"Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product.","status":"published","published":"2024-02-01T03:56:12Z","modified":"2025-06-04T15:25:00Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:30.107804Z"}],"ghsa":[{"id":"GHSA-5rhg-f75j-57f8","title":"Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and...","description":"Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product.","status":"published","published":"2024-02-01T06:31:05Z","modified":"2026-03-17T05:04:57Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:06:39.944141Z"}],"nvd":[{"id":"CVE-2024-23941","description":"Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product.","status":"published","published":"2024-02-01T04:15:49.967Z","modified":"2026-06-17T07:13:55.407Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:09:34.891666Z"}],"osv":[{"id":"CVE-2024-23941","description":"Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product.","status":"published","published":"2024-02-01T03:56:12.231Z","modified":"2026-10-28T02:30:28.88819222Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:38.897406Z"}]}}