CVE-2024-22220

Published: Feb 21, 2024Modified: May 8, 2025

6.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Exploitability: 2.8 / Impact: 3.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An issue was discovered in Terminalfour 7.4 through 7.4.0004 QP3 and 8 through 8.3.19, and Formbank through 2.1.10-FINAL. Unauthenticated Stored Cross-Site Scripting can occur, with resultant Admin Session Hijacking. The attack vectors are Form Builder and Form Preview.

Affected (5)

Products: Terminalfour: Formbank, Terminalfour

Terminalfour

2 products

Formbank

Terminalfour

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Terminalfour Formbank	Up to 2.1.10
Terminalfour Terminalfour	From 7.4 to 7.4.0004
Terminalfour Terminalfour	From 8.0.0 to 8.3.19
Terminalfour Terminalfour	Version 7.4.0004 qp2
Terminalfour Terminalfour	Version 7.4.0004 qp3