CVE-2024-4327 json
Apryse WebViewer PDF Document cross site scripting
published 2024-04-30 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-43969
- cvss
- 3.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 39%
- public exploits
- 0
- none known
Summary
A vulnerability was found in Apryse WebViewer up to 10.8.0. It has been classified as problematic. This affects an unknown part of the component PDF Document Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 10.9 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-262419. NOTE: The vendor was contacted early about this disclosure and explains that the documentation recommends a strict Content Security Policy and the issue was fixed in release 10.9.
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.46% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- 1drv.ms https://1drv.ms/b/s!AqJ7dHWS4CD_l0acw2hDjgo-C2zC?e=DOGPmq referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N |
| CNA | 3.0 | 3.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N |
| CNA | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:N/I:P/A:N |
Affected products
- Apryse WebViewer
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
1drv.ms
/b/s!AqJ7dHWS4CD_l0acw2hDjgo-C2zC?e=DOGPmq
exploit
-
vuldb.com
/?id.262419
vdb-entry, mitigation
-
vuldb.com
/?ctiid.262419
signature, permissions-required
-
vuldb.com
/?submit.321231
third-party-advisory
-
docs.apryse.com
/documentation/web/faq/content-security-policy/#recommended-policy
mitigation
Sources
- CVE List CVE-2024-4327
- NVD CVE-2024-4327
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.