CVE-2024-33670: Passbolt API · Cross-site Scripting
Source CVE Database V5
Not known to be exploited · CVSS 4.3 Medium · fixed in 4.6.2 : update affected systems when convenient.
Data as of 26 Oct 2026, 10:12 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 41% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 4.6.2
CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:RExploitation evidence
Disclosed: evidence found.
CVE published 26 Apr 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
- Upgrade Passbolt API to version 4.6.2 or later immediately, as this version contains the fix for the HTML injection vulnerability.
- Implement strict input validation and sanitization on all URL parameters to prevent injection of malicious HTML content.
- Enforce and regularly review Content Security Policy (CSP) headers to ensure they effectively block script execution and limit the impact of injected content.
- Educate users about the risks of clicking on unsolicited or suspicious URLs, especially those purporting to be from internal tools like Passbolt.
- Conduct regular security assessments and penetration testing focused on injection vulnerabilities and UI manipulation risks.
- Monitor web server and application logs for unusual URL patterns or access attempts that may indicate exploitation attempts.
- Consider implementing additional security headers such as X-Content-Type-Options and X-Frame-Options to reduce attack surface.
- If upgrading immediately is not feasible, apply temporary mitigations such as URL parameter filtering at the web application firewall (WAF) level to block suspicious inputs.
Description
Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript due to Content Security Policy (CSP) restrictions, it may still impact the appearance and user interaction of the page.