CVE-2024-27794

Claris FileMaker Server before version 20.3.2 was susceptible to a reflected Cross-Site Scripting vulnerability due to an improperly handled parameter in the FileMaker WebDirect login endpoint. The vulnerability was resolved in FileMaker Server 20.3.2 by escaping the HTML contents of the login error message on the login page.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://support.claris.com/s/article/Security-Vulnerability-in-Claris-FileMaker-Server?language=en_US	Vendor Advisory
https://support.claris.com/s/article/Security-Vulnerability-in-Claris-FileMaker-Server?language=en_US	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:claris:filemaker_server:*:*:*:*:*:*:*:*

History

11 Dec 2024, 19:56

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~4.3~~	v2 : unknown v3 : 6.1
CPE		cpe:2.3:a:claris:filemaker_server::::::::
First Time		Claris filemaker Server Claris
References	~~() https://support.claris.com/s/article/Security-Vulnerability-in-Claris-FileMaker-Server?language=en_US -~~	() https://support.claris.com/s/article/Security-Vulnerability-in-Claris-FileMaker-Server?language=en_US - Vendor Advisory

21 Nov 2024, 09:05

Type	Values Removed	Values Added
References	~~() https://support.claris.com/s/article/Security-Vulnerability-in-Claris-FileMaker-Server?language=en_US -~~	() https://support.claris.com/s/article/Security-Vulnerability-in-Claris-FileMaker-Server?language=en_US -

03 Jul 2024, 01:50

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.3
CWE		CWE-79

15 Apr 2024, 23:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-04-15 23:15

Updated : 2024-12-11 19:56

NVD link : CVE-2024-27794

Mitre link : CVE-2024-27794

CVE.ORG link : CVE-2024-27794

JSON object : View

Products Affected

claris

filemaker_server

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-27794", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2024-04-15T23:15:06.890", "references": [{"url": "https://support.claris.com/s/article/Security-Vulnerability-in-Claris-FileMaker-Server?language=en_US", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "https://support.claris.com/s/article/Security-Vulnerability-in-Claris-FileMaker-Server?language=en_US", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Claris FileMaker Server before version 20.3.2 was susceptible to a reflected Cross-Site Scripting vulnerability due to an improperly handled parameter in the FileMaker WebDirect login endpoint. The vulnerability was resolved in FileMaker Server 20.3.2 by escaping the HTML contents of the login error message on the login page."}, {"lang": "es", "value": "Claris FileMaker Server anterior a la versi\u00f3n 20.3.2 era susceptible a una vulnerabilidad de Cross-Site Scripting reflejada debido a un par\u00e1metro manejado incorrectamente en el endpoint de inicio de sesi\u00f3n de FileMaker WebDirect. La vulnerabilidad se resolvi\u00f3 en FileMaker Server 20.3.2 escapando del contenido HTML del mensaje de error de inicio de sesi\u00f3n en la p\u00e1gina de inicio de sesi\u00f3n."}], "lastModified": "2024-12-11T19:56:37.067", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:claris:filemaker_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C78CBE2B-EEF8-4BC4-ADE2-339D6D23019B", "versionEndExcluding": "20.3.2"}], "operator": "OR"}]}], "sourceIdentifier": "product-security@apple.com"}