Medium severity · published Jan 18, 2024
CVE-2024-22418
Group-Office is an enterprise CRM and groupware tool
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
Group-Office is an enterprise CRM and groupware tool. Affected versions are subject to a vulnerability which is present in the file upload mechanism of Group Office. It allows an attacker to execute arbitrary JavaScript code by embedding it within a file's name. For instance, using a filename such as “><img src=x onerror=prompt('XSS')>.jpg” triggers the vulnerability. When this file is uploaded, the JavaScript code within the filename is executed. This issue has been addressed in version 6.8.29. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
Group Office · Group-office
before 6.8.29 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-22418
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-22418
Patch
https://github.com/Intermesh/groupoffice/commit/2a52a5d42d080db6738d70eba30294bcd94ebd09
Exploit
https://github.com/Intermesh/groupoffice/security/advisories/GHSA-p7w9-h6c3-wqpp
More from Group Office
8.8
CVE-2026-25512
Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler
8.8
CVE-2026-25134
Group-Office Argument Injection in MaintenanceController::actionZipLanguage
8.8
CVE-2025-63406
An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbToApi() and eval() in the…
8.8
CVE-2023-46730
Group-Office is an enterprise CRM and groupware tool
6.1
CVE-2023-25292
Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information via the GO_LANGUAGE…