{"id":"CVE-2024-24510","aliases":["DEBIAN-CVE-2024-24510","EUVD-2024-21929","GHSA-3x4h-m49h-pxr3","UBUNTU-CVE-2024-24510"],"status":"published","title":"Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to...","description":"Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function to the mail component.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00483,"percentile":0.42087,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2024-09-09T00:00:00Z","modified":"2026-11-02T12:00:59Z","fixes":[{"ecosystem":"Debian:12","package":"sogo","fixed_in":["5.8.0-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sogo","fixed_in":["5.10.0-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.0-2+deb12u1"}]}],"versions":["5.8.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.17a-1","2.2.17a-1.1","2.2.17a-1.1build1","2.2.17a-1.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.10-1","3.2.10-1build1","3.2.10-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.8-1","4.1.0-1","4.1.1-1","4.3.0-1","4.3.0-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.0-1","5.2.0-1","5.2.0-3","5.3.0-1","5.3.0-1build2","5.4.0-1","5.5.0-1","5.5.1-1","5.5.1-1ubuntu0.1~esm1"]}],"products":[{"vendor":"alinto","product":"sogo"}],"references":[{"url":"https://book.hacktricks.xyz/pentesting-web/xs-search/css-injection","tags":["Broken Link","web","report"]},{"url":"https://github.com/Alinto/sogo/commit/21468700718ed71774eaf2979ee59330fc569424","tags":["Patch","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24510","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3x4h-m49h-pxr3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24510.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-24510","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-24510","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24510","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-24510","description":"Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function to the mail component.","status":"published","published":"2024-09-09T00:00:00Z","modified":"2024-11-05T20:59:33.851Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:13.991836Z"}],"euvd":[{"id":"EUVD-2024-21929","description":"Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function to the mail component.","status":"published","published":"2024-09-09T00:00:00Z","modified":"2024-11-05T20:59:33Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:05:10.508802Z"}],"ghsa":[{"id":"GHSA-3x4h-m49h-pxr3","title":"Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to...","description":"Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function to the mail component.","status":"published","published":"2024-09-09T21:31:22Z","modified":"2024-11-06T00:32:58Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:58:44.780147Z"}],"nvd":[{"id":"CVE-2024-24510","description":"Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function to the mail component.","status":"published","published":"2024-09-09T19:15:13.197Z","modified":"2026-06-17T07:14:33.66Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:25.561537Z"}],"osv":[{"id":"CVE-2024-24510","description":"Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function to the mail component.","status":"published","published":"2024-09-09T00:00:00Z","modified":"2026-10-28T02:30:23.283883936Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:38.897406Z"},{"id":"DEBIAN-CVE-2024-24510","description":"Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function to the mail component.","status":"published","published":"2024-09-09T19:15:13.197Z","modified":"2026-11-02T12:00:59.379526156Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"UBUNTU-CVE-2024-24510","description":"Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function to the mail component.","status":"published","published":"2024-09-09T19:15:00Z","modified":"2026-07-06T02:45:07.13981371Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:42.68848Z"}]}}