CVE-2024-45745

TopQuadrant TopBraid EDG JavaScript console XXE

CVSS 5 MEDIUMEPSS 0.3%CWE-611

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

27 Sep 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

TopQuadrant TopBraid EDG before version 8.0.1 allows an authenticated attacker to upload an XML DTD file and execute JavaScript to read local files or access URLs (XXE). Fixed in 8.0.1 (bug fix: TBS-6721).

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Affected products

TopQuadrant · TopBraid EDG

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2024/va-24-254-02.json https://www.topquadrant.com/wp-content/uploads/2024/06/changelog-8.0.1.txt