CVE-2024-27092

CVSS V2 None CVSS V3 None
Description
Hoppscotch is an API development ecosystem. Due to lack of validation for fields like Label (Edit Team) - TeamName, bad actors can send emails with Spoofed Content as Hoppscotch. Part of payload (external link) is presented in clickable form - easier to achieve own goals by malicious actors. This issue is fixed in 2023.12.6.
Overview
  • CVE ID
  • CVE-2024-27092
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-02-26T19:40:57.427Z
  • Last Modified Date
  • 2024-02-26T19:40:57.427Z
Weakness Enumerations
CWE URL
CWE-20 http://cwe.mitre.org/data/definitions/20.html
CWE-79 http://cwe.mitre.org/data/definitions/79.html
References
Reference URL Reference Tags
https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-8r6h-8r68-q3pp x_refsource_CONFIRM
https://github.com/hoppscotch/hoppscotch/commit/6827e97ec583b2534cdc1c2f33fa44973a0c2bf5 x_refsource_MISC
https://github.com/hoppscotch/hoppscotch/blob/main/packages/hoppscotch-backend/src/team-invitation/team-invitation.service.ts#L153 x_refsource_MISC
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2024-27092
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27092
History
Created Old Value New Value Data Type Notes
2024-06-26 01:35:13 Added to TrackCVE